Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe
-
Size
520KB
-
MD5
172fa0995f9bffdac17c2ee5eab069f5
-
SHA1
e27798d25c06ab0564e715702146bb0ddc455215
-
SHA256
883c22c7a7e49b51d3accc044e2877da2a798300b96720ee5e4f1c4de0912749
-
SHA512
28ac175cab786d7167a9276a43c150d151318c7047759f8e4ce1cc53904d7f09122576b1bae199f83925066c565a311935ddf8c5e08321826b5e73ea4c1889d2
-
SSDEEP
12288:roRXOQjmOyuMqWHhMzdSur/BRiep+jI0kIXNZ:rogQ9yuChKSs9pGNkIXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2928 6D4.tmp 3024 741.tmp 2616 7BE.tmp 2612 82B.tmp 2428 889.tmp 2680 8E6.tmp 2508 944.tmp 2468 9B1.tmp 2436 A2E.tmp 2880 A9B.tmp 2056 AF9.tmp 2408 B56.tmp 2520 B95.tmp 2788 C02.tmp 1772 C6F.tmp 340 CDC.tmp 2312 D4A.tmp 1564 DA7.tmp 1252 E14.tmp 1152 E72.tmp 2180 ED0.tmp 1056 F1E.tmp 1688 F7B.tmp 1668 FBA.tmp 1912 FF8.tmp 1944 1036.tmp 2828 1075.tmp 1880 10B3.tmp 2232 10F2.tmp 528 1140.tmp 2824 118E.tmp 1420 11CC.tmp 1412 120A.tmp 1804 1258.tmp 348 1297.tmp 2396 12E5.tmp 2992 1323.tmp 1232 1362.tmp 1112 13A0.tmp 3028 13DE.tmp 2292 141D.tmp 1704 145B.tmp 1320 149A.tmp 1684 14D8.tmp 2844 1526.tmp 960 1574.tmp 1144 15C2.tmp 1896 1600.tmp 1900 163F.tmp 568 167D.tmp 1740 16BC.tmp 1424 16FA.tmp 1744 1738.tmp 320 1777.tmp 1796 17B5.tmp 1504 1803.tmp 1540 1851.tmp 2632 189F.tmp 2928 18DE.tmp 2620 192C.tmp 2628 196A.tmp 2616 19B8.tmp 2808 1A06.tmp 2536 1A44.tmp -
Loads dropped DLL 64 IoCs
pid Process 2916 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 2928 6D4.tmp 3024 741.tmp 2616 7BE.tmp 2612 82B.tmp 2428 889.tmp 2680 8E6.tmp 2508 944.tmp 2468 9B1.tmp 2436 A2E.tmp 2880 A9B.tmp 2056 AF9.tmp 2408 B56.tmp 2520 B95.tmp 2788 C02.tmp 1772 C6F.tmp 340 CDC.tmp 2312 D4A.tmp 1564 DA7.tmp 1252 E14.tmp 1152 E72.tmp 2180 ED0.tmp 1056 F1E.tmp 1688 F7B.tmp 1668 FBA.tmp 1912 FF8.tmp 1944 1036.tmp 2828 1075.tmp 1880 10B3.tmp 2232 10F2.tmp 528 1140.tmp 2824 118E.tmp 1420 11CC.tmp 1412 120A.tmp 1804 1258.tmp 348 1297.tmp 2396 12E5.tmp 2992 1323.tmp 1232 1362.tmp 1112 13A0.tmp 3028 13DE.tmp 2292 141D.tmp 1704 145B.tmp 1320 149A.tmp 1684 14D8.tmp 2844 1526.tmp 960 1574.tmp 1144 15C2.tmp 1896 1600.tmp 1900 163F.tmp 568 167D.tmp 1740 16BC.tmp 1424 16FA.tmp 1744 1738.tmp 320 1777.tmp 1796 17B5.tmp 1504 1803.tmp 1540 1851.tmp 2632 189F.tmp 2928 18DE.tmp 2620 192C.tmp 2628 196A.tmp 2616 19B8.tmp 2808 1A06.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2928 2916 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 28 PID 2916 wrote to memory of 2928 2916 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 28 PID 2916 wrote to memory of 2928 2916 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 28 PID 2916 wrote to memory of 2928 2916 2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe 28 PID 2928 wrote to memory of 3024 2928 6D4.tmp 29 PID 2928 wrote to memory of 3024 2928 6D4.tmp 29 PID 2928 wrote to memory of 3024 2928 6D4.tmp 29 PID 2928 wrote to memory of 3024 2928 6D4.tmp 29 PID 3024 wrote to memory of 2616 3024 741.tmp 30 PID 3024 wrote to memory of 2616 3024 741.tmp 30 PID 3024 wrote to memory of 2616 3024 741.tmp 30 PID 3024 wrote to memory of 2616 3024 741.tmp 30 PID 2616 wrote to memory of 2612 2616 7BE.tmp 31 PID 2616 wrote to memory of 2612 2616 7BE.tmp 31 PID 2616 wrote to memory of 2612 2616 7BE.tmp 31 PID 2616 wrote to memory of 2612 2616 7BE.tmp 31 PID 2612 wrote to memory of 2428 2612 82B.tmp 32 PID 2612 wrote to memory of 2428 2612 82B.tmp 32 PID 2612 wrote to memory of 2428 2612 82B.tmp 32 PID 2612 wrote to memory of 2428 2612 82B.tmp 32 PID 2428 wrote to memory of 2680 2428 889.tmp 33 PID 2428 wrote to memory of 2680 2428 889.tmp 33 PID 2428 wrote to memory of 2680 2428 889.tmp 33 PID 2428 wrote to memory of 2680 2428 889.tmp 33 PID 2680 wrote to memory of 2508 2680 8E6.tmp 34 PID 2680 wrote to memory of 2508 2680 8E6.tmp 34 PID 2680 wrote to memory of 2508 2680 8E6.tmp 34 PID 2680 wrote to memory of 2508 2680 8E6.tmp 34 PID 2508 wrote to memory of 2468 2508 944.tmp 35 PID 2508 wrote to memory of 2468 2508 944.tmp 35 PID 2508 wrote to memory of 2468 2508 944.tmp 35 PID 2508 wrote to memory of 2468 2508 944.tmp 35 PID 2468 wrote to memory of 2436 2468 9B1.tmp 36 PID 2468 wrote to memory of 2436 2468 9B1.tmp 36 PID 2468 wrote to memory of 2436 2468 9B1.tmp 36 PID 2468 wrote to memory of 2436 2468 9B1.tmp 36 PID 2436 wrote to memory of 2880 2436 A2E.tmp 37 PID 2436 wrote to memory of 2880 2436 A2E.tmp 37 PID 2436 wrote to memory of 2880 2436 A2E.tmp 37 PID 2436 wrote to memory of 2880 2436 A2E.tmp 37 PID 2880 wrote to memory of 2056 2880 A9B.tmp 38 PID 2880 wrote to memory of 2056 2880 A9B.tmp 38 PID 2880 wrote to memory of 2056 2880 A9B.tmp 38 PID 2880 wrote to memory of 2056 2880 A9B.tmp 38 PID 2056 wrote to memory of 2408 2056 AF9.tmp 39 PID 2056 wrote to memory of 2408 2056 AF9.tmp 39 PID 2056 wrote to memory of 2408 2056 AF9.tmp 39 PID 2056 wrote to memory of 2408 2056 AF9.tmp 39 PID 2408 wrote to memory of 2520 2408 B56.tmp 40 PID 2408 wrote to memory of 2520 2408 B56.tmp 40 PID 2408 wrote to memory of 2520 2408 B56.tmp 40 PID 2408 wrote to memory of 2520 2408 B56.tmp 40 PID 2520 wrote to memory of 2788 2520 B95.tmp 41 PID 2520 wrote to memory of 2788 2520 B95.tmp 41 PID 2520 wrote to memory of 2788 2520 B95.tmp 41 PID 2520 wrote to memory of 2788 2520 B95.tmp 41 PID 2788 wrote to memory of 1772 2788 C02.tmp 42 PID 2788 wrote to memory of 1772 2788 C02.tmp 42 PID 2788 wrote to memory of 1772 2788 C02.tmp 42 PID 2788 wrote to memory of 1772 2788 C02.tmp 42 PID 1772 wrote to memory of 340 1772 C6F.tmp 43 PID 1772 wrote to memory of 340 1772 C6F.tmp 43 PID 1772 wrote to memory of 340 1772 C6F.tmp 43 PID 1772 wrote to memory of 340 1772 C6F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_172fa0995f9bffdac17c2ee5eab069f5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"67⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"69⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"70⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"71⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"72⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"73⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"75⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"76⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"77⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"78⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"79⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"80⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"81⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"82⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"83⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"84⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"85⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"86⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"88⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"89⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"91⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"92⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"93⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"94⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"95⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"96⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"97⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"98⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"99⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"100⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"101⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"102⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"104⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"105⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"106⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"107⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"108⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"109⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"110⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"111⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"112⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"113⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"114⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"115⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"116⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"117⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"118⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"119⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"120⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"121⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"122⤵PID:1744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-