Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 20:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe
-
Size
541KB
-
MD5
0f971bea56fdef26518e6cb850ea18c4
-
SHA1
dde216fff38d11fed036f266ac1a59d3335d2d3f
-
SHA256
695a6ccb16582bbeebb991bb6a3ad643c0dd32f46dc9eec7c2d6e7b019a68619
-
SHA512
1219400bf1355c56ce5d01540157e9870f4c29471999890ade6e49d5eef0818dc73f1cb0e411352b068073a7a601a247ac2cb53baa7589f35009ac77cd0df4ac
-
SSDEEP
12288:UU5rCOTeifjDBt4/AgnsFcIkRkxSVpZ2rZa73ctO:UUQOJf3s7sFXNrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2908 13A0.tmp 1580 140D.tmp 2644 147A.tmp 2632 14D8.tmp 2536 1545.tmp 2724 15A3.tmp 2448 1610.tmp 2664 167D.tmp 2472 16EA.tmp 2888 1748.tmp 2904 17B5.tmp 2604 1822.tmp 2764 1880.tmp 2880 18ED.tmp 1552 195A.tmp 1652 19C8.tmp 2140 1A35.tmp 2036 1AA2.tmp 1356 1AF0.tmp 2708 1B4E.tmp 828 1BAB.tmp 1696 1C28.tmp 2204 1C76.tmp 2128 1CB4.tmp 1856 1CF3.tmp 1600 1D41.tmp 2836 1D7F.tmp 2208 1DBE.tmp 536 1E0C.tmp 336 1E4A.tmp 328 1E88.tmp 1180 1ED6.tmp 1404 1F24.tmp 1484 1F72.tmp 1444 1FC0.tmp 1020 200E.tmp 2312 205C.tmp 1604 20AA.tmp 3044 20F8.tmp 1436 2146.tmp 1804 2194.tmp 1944 21E2.tmp 1008 2240.tmp 1256 227E.tmp 1904 22CC.tmp 1648 231A.tmp 716 2359.tmp 2272 2397.tmp 2156 23D6.tmp 2136 2414.tmp 2176 2462.tmp 1216 24A0.tmp 2876 24DF.tmp 2376 251D.tmp 2748 256B.tmp 1540 25AA.tmp 2120 25F8.tmp 2992 2636.tmp 2560 2684.tmp 2660 26D2.tmp 2640 2720.tmp 2544 276E.tmp 1376 27BC.tmp 2536 280A.tmp -
Loads dropped DLL 64 IoCs
pid Process 292 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 2908 13A0.tmp 1580 140D.tmp 2644 147A.tmp 2632 14D8.tmp 2536 1545.tmp 2724 15A3.tmp 2448 1610.tmp 2664 167D.tmp 2472 16EA.tmp 2888 1748.tmp 2904 17B5.tmp 2604 1822.tmp 2764 1880.tmp 2880 18ED.tmp 1552 195A.tmp 1652 19C8.tmp 2140 1A35.tmp 2036 1AA2.tmp 1356 1AF0.tmp 2708 1B4E.tmp 828 1BAB.tmp 1696 1C28.tmp 2204 1C76.tmp 2128 1CB4.tmp 1856 1CF3.tmp 1600 1D41.tmp 2836 1D7F.tmp 2208 1DBE.tmp 536 1E0C.tmp 336 1E4A.tmp 328 1E88.tmp 1180 1ED6.tmp 1404 1F24.tmp 1484 1F72.tmp 1444 1FC0.tmp 1020 200E.tmp 2312 205C.tmp 1604 20AA.tmp 3044 20F8.tmp 1436 2146.tmp 1804 2194.tmp 1944 21E2.tmp 1008 2240.tmp 1256 227E.tmp 1904 22CC.tmp 1648 231A.tmp 716 2359.tmp 2272 2397.tmp 2156 23D6.tmp 2136 2414.tmp 2176 2462.tmp 1216 24A0.tmp 2876 24DF.tmp 2376 251D.tmp 2748 256B.tmp 1540 25AA.tmp 2120 25F8.tmp 2992 2636.tmp 2560 2684.tmp 2660 26D2.tmp 2640 2720.tmp 2544 276E.tmp 1376 27BC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 292 wrote to memory of 2908 292 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 28 PID 292 wrote to memory of 2908 292 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 28 PID 292 wrote to memory of 2908 292 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 28 PID 292 wrote to memory of 2908 292 2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe 28 PID 2908 wrote to memory of 1580 2908 13A0.tmp 29 PID 2908 wrote to memory of 1580 2908 13A0.tmp 29 PID 2908 wrote to memory of 1580 2908 13A0.tmp 29 PID 2908 wrote to memory of 1580 2908 13A0.tmp 29 PID 1580 wrote to memory of 2644 1580 140D.tmp 30 PID 1580 wrote to memory of 2644 1580 140D.tmp 30 PID 1580 wrote to memory of 2644 1580 140D.tmp 30 PID 1580 wrote to memory of 2644 1580 140D.tmp 30 PID 2644 wrote to memory of 2632 2644 147A.tmp 31 PID 2644 wrote to memory of 2632 2644 147A.tmp 31 PID 2644 wrote to memory of 2632 2644 147A.tmp 31 PID 2644 wrote to memory of 2632 2644 147A.tmp 31 PID 2632 wrote to memory of 2536 2632 14D8.tmp 32 PID 2632 wrote to memory of 2536 2632 14D8.tmp 32 PID 2632 wrote to memory of 2536 2632 14D8.tmp 32 PID 2632 wrote to memory of 2536 2632 14D8.tmp 32 PID 2536 wrote to memory of 2724 2536 1545.tmp 33 PID 2536 wrote to memory of 2724 2536 1545.tmp 33 PID 2536 wrote to memory of 2724 2536 1545.tmp 33 PID 2536 wrote to memory of 2724 2536 1545.tmp 33 PID 2724 wrote to memory of 2448 2724 15A3.tmp 34 PID 2724 wrote to memory of 2448 2724 15A3.tmp 34 PID 2724 wrote to memory of 2448 2724 15A3.tmp 34 PID 2724 wrote to memory of 2448 2724 15A3.tmp 34 PID 2448 wrote to memory of 2664 2448 1610.tmp 35 PID 2448 wrote to memory of 2664 2448 1610.tmp 35 PID 2448 wrote to memory of 2664 2448 1610.tmp 35 PID 2448 wrote to memory of 2664 2448 1610.tmp 35 PID 2664 wrote to memory of 2472 2664 167D.tmp 36 PID 2664 wrote to memory of 2472 2664 167D.tmp 36 PID 2664 wrote to memory of 2472 2664 167D.tmp 36 PID 2664 wrote to memory of 2472 2664 167D.tmp 36 PID 2472 wrote to memory of 2888 2472 16EA.tmp 37 PID 2472 wrote to memory of 2888 2472 16EA.tmp 37 PID 2472 wrote to memory of 2888 2472 16EA.tmp 37 PID 2472 wrote to memory of 2888 2472 16EA.tmp 37 PID 2888 wrote to memory of 2904 2888 1748.tmp 38 PID 2888 wrote to memory of 2904 2888 1748.tmp 38 PID 2888 wrote to memory of 2904 2888 1748.tmp 38 PID 2888 wrote to memory of 2904 2888 1748.tmp 38 PID 2904 wrote to memory of 2604 2904 17B5.tmp 39 PID 2904 wrote to memory of 2604 2904 17B5.tmp 39 PID 2904 wrote to memory of 2604 2904 17B5.tmp 39 PID 2904 wrote to memory of 2604 2904 17B5.tmp 39 PID 2604 wrote to memory of 2764 2604 1822.tmp 40 PID 2604 wrote to memory of 2764 2604 1822.tmp 40 PID 2604 wrote to memory of 2764 2604 1822.tmp 40 PID 2604 wrote to memory of 2764 2604 1822.tmp 40 PID 2764 wrote to memory of 2880 2764 1880.tmp 41 PID 2764 wrote to memory of 2880 2764 1880.tmp 41 PID 2764 wrote to memory of 2880 2764 1880.tmp 41 PID 2764 wrote to memory of 2880 2764 1880.tmp 41 PID 2880 wrote to memory of 1552 2880 18ED.tmp 42 PID 2880 wrote to memory of 1552 2880 18ED.tmp 42 PID 2880 wrote to memory of 1552 2880 18ED.tmp 42 PID 2880 wrote to memory of 1552 2880 18ED.tmp 42 PID 1552 wrote to memory of 1652 1552 195A.tmp 43 PID 1552 wrote to memory of 1652 1552 195A.tmp 43 PID 1552 wrote to memory of 1652 1552 195A.tmp 43 PID 1552 wrote to memory of 1652 1552 195A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_0f971bea56fdef26518e6cb850ea18c4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"66⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"67⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"69⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"70⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"72⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"73⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"74⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"75⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"76⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"78⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"79⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"80⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"81⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"82⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"83⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"84⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"85⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"86⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"87⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"88⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"89⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"90⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"91⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"93⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"94⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"95⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"96⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"97⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"98⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"99⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"100⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"101⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"103⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"104⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"105⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"106⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"107⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"108⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"109⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"111⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"112⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"113⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"114⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"115⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"116⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"117⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"118⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"119⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"121⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-