Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe
-
Size
520KB
-
MD5
c464ba43cdf44ac5546c464ea7760f06
-
SHA1
b996aa1aea694fdbbe790273f51a57cfa1002bbf
-
SHA256
ca0df65fe15ea5272620d2c147beab19aa0b96a894aa86c92f30ea898e8c4ccd
-
SHA512
a35692c6651af44afff20cc28e404d20ca05b16ff487b2c478c7fffec659c146b272e7bd1eb04d630dc12b88697d014d9a421a964d25e477138209fb18b94fac
-
SSDEEP
12288:roRXOQjmOyoeLSDbYLhDRsU+rNqEa3RWrnfNZ:rogQ9yoeeDbYNlspoX3MrnfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2132 FD9.tmp 2932 1046.tmp 2036 10C3.tmp 3052 1101.tmp 2504 114F.tmp 2624 119D.tmp 2660 11DC.tmp 2516 122A.tmp 2428 1268.tmp 2444 12B6.tmp 2412 1314.tmp 2916 1362.tmp 2100 13A0.tmp 2120 13FE.tmp 1744 144C.tmp 1916 148A.tmp 1244 14C8.tmp 1700 1536.tmp 2460 1584.tmp 2156 15D2.tmp 1588 1610.tmp 2704 166E.tmp 2700 16AC.tmp 2692 16EA.tmp 2796 1738.tmp 1452 1777.tmp 2980 17B5.tmp 2848 17F4.tmp 336 1832.tmp 984 1870.tmp 1092 18AF.tmp 560 18ED.tmp 832 192C.tmp 1708 196A.tmp 1140 19A8.tmp 908 19D7.tmp 2060 1A16.tmp 1660 1A54.tmp 1728 1A83.tmp 1212 1AC1.tmp 1488 1B00.tmp 1328 1B3E.tmp 2800 1B9C.tmp 1556 1BEA.tmp 900 1C47.tmp 2764 1C95.tmp 2136 1CF3.tmp 2728 1D70.tmp 1988 1DBE.tmp 2892 1DFC.tmp 2908 1E3A.tmp 2000 1E79.tmp 888 1EC7.tmp 808 1F05.tmp 1512 1F53.tmp 1672 1F92.tmp 2040 1FE0.tmp 2132 201E.tmp 2012 206C.tmp 2940 20AA.tmp 1268 20E9.tmp 2956 2127.tmp 2612 2166.tmp 2544 21A4.tmp -
Loads dropped DLL 64 IoCs
pid Process 1712 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 2132 FD9.tmp 2932 1046.tmp 2036 10C3.tmp 3052 1101.tmp 2504 114F.tmp 2624 119D.tmp 2660 11DC.tmp 2516 122A.tmp 2428 1268.tmp 2444 12B6.tmp 2412 1314.tmp 2916 1362.tmp 2100 13A0.tmp 2120 13FE.tmp 1744 144C.tmp 1916 148A.tmp 1244 14C8.tmp 1700 1536.tmp 2460 1584.tmp 2156 15D2.tmp 1588 1610.tmp 2704 166E.tmp 2700 16AC.tmp 2692 16EA.tmp 2796 1738.tmp 1452 1777.tmp 2980 17B5.tmp 2848 17F4.tmp 336 1832.tmp 984 1870.tmp 1092 18AF.tmp 560 18ED.tmp 832 192C.tmp 1708 196A.tmp 1140 19A8.tmp 908 19D7.tmp 2060 1A16.tmp 1660 1A54.tmp 1728 1A83.tmp 1212 1AC1.tmp 1488 1B00.tmp 1328 1B3E.tmp 2800 1B9C.tmp 1556 1BEA.tmp 900 1C47.tmp 2764 1C95.tmp 2136 1CF3.tmp 2728 1D70.tmp 1988 1DBE.tmp 2892 1DFC.tmp 2908 1E3A.tmp 2000 1E79.tmp 888 1EC7.tmp 808 1F05.tmp 1512 1F53.tmp 1672 1F92.tmp 2040 1FE0.tmp 2132 201E.tmp 2012 206C.tmp 2940 20AA.tmp 1268 20E9.tmp 2956 2127.tmp 2612 2166.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2132 1712 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 28 PID 1712 wrote to memory of 2132 1712 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 28 PID 1712 wrote to memory of 2132 1712 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 28 PID 1712 wrote to memory of 2132 1712 2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe 28 PID 2132 wrote to memory of 2932 2132 FD9.tmp 29 PID 2132 wrote to memory of 2932 2132 FD9.tmp 29 PID 2132 wrote to memory of 2932 2132 FD9.tmp 29 PID 2132 wrote to memory of 2932 2132 FD9.tmp 29 PID 2932 wrote to memory of 2036 2932 1046.tmp 30 PID 2932 wrote to memory of 2036 2932 1046.tmp 30 PID 2932 wrote to memory of 2036 2932 1046.tmp 30 PID 2932 wrote to memory of 2036 2932 1046.tmp 30 PID 2036 wrote to memory of 3052 2036 10C3.tmp 31 PID 2036 wrote to memory of 3052 2036 10C3.tmp 31 PID 2036 wrote to memory of 3052 2036 10C3.tmp 31 PID 2036 wrote to memory of 3052 2036 10C3.tmp 31 PID 3052 wrote to memory of 2504 3052 1101.tmp 32 PID 3052 wrote to memory of 2504 3052 1101.tmp 32 PID 3052 wrote to memory of 2504 3052 1101.tmp 32 PID 3052 wrote to memory of 2504 3052 1101.tmp 32 PID 2504 wrote to memory of 2624 2504 114F.tmp 33 PID 2504 wrote to memory of 2624 2504 114F.tmp 33 PID 2504 wrote to memory of 2624 2504 114F.tmp 33 PID 2504 wrote to memory of 2624 2504 114F.tmp 33 PID 2624 wrote to memory of 2660 2624 119D.tmp 34 PID 2624 wrote to memory of 2660 2624 119D.tmp 34 PID 2624 wrote to memory of 2660 2624 119D.tmp 34 PID 2624 wrote to memory of 2660 2624 119D.tmp 34 PID 2660 wrote to memory of 2516 2660 11DC.tmp 35 PID 2660 wrote to memory of 2516 2660 11DC.tmp 35 PID 2660 wrote to memory of 2516 2660 11DC.tmp 35 PID 2660 wrote to memory of 2516 2660 11DC.tmp 35 PID 2516 wrote to memory of 2428 2516 122A.tmp 36 PID 2516 wrote to memory of 2428 2516 122A.tmp 36 PID 2516 wrote to memory of 2428 2516 122A.tmp 36 PID 2516 wrote to memory of 2428 2516 122A.tmp 36 PID 2428 wrote to memory of 2444 2428 1268.tmp 37 PID 2428 wrote to memory of 2444 2428 1268.tmp 37 PID 2428 wrote to memory of 2444 2428 1268.tmp 37 PID 2428 wrote to memory of 2444 2428 1268.tmp 37 PID 2444 wrote to memory of 2412 2444 12B6.tmp 38 PID 2444 wrote to memory of 2412 2444 12B6.tmp 38 PID 2444 wrote to memory of 2412 2444 12B6.tmp 38 PID 2444 wrote to memory of 2412 2444 12B6.tmp 38 PID 2412 wrote to memory of 2916 2412 1314.tmp 39 PID 2412 wrote to memory of 2916 2412 1314.tmp 39 PID 2412 wrote to memory of 2916 2412 1314.tmp 39 PID 2412 wrote to memory of 2916 2412 1314.tmp 39 PID 2916 wrote to memory of 2100 2916 1362.tmp 40 PID 2916 wrote to memory of 2100 2916 1362.tmp 40 PID 2916 wrote to memory of 2100 2916 1362.tmp 40 PID 2916 wrote to memory of 2100 2916 1362.tmp 40 PID 2100 wrote to memory of 2120 2100 13A0.tmp 41 PID 2100 wrote to memory of 2120 2100 13A0.tmp 41 PID 2100 wrote to memory of 2120 2100 13A0.tmp 41 PID 2100 wrote to memory of 2120 2100 13A0.tmp 41 PID 2120 wrote to memory of 1744 2120 13FE.tmp 42 PID 2120 wrote to memory of 1744 2120 13FE.tmp 42 PID 2120 wrote to memory of 1744 2120 13FE.tmp 42 PID 2120 wrote to memory of 1744 2120 13FE.tmp 42 PID 1744 wrote to memory of 1916 1744 144C.tmp 43 PID 1744 wrote to memory of 1916 1744 144C.tmp 43 PID 1744 wrote to memory of 1916 1744 144C.tmp 43 PID 1744 wrote to memory of 1916 1744 144C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_c464ba43cdf44ac5546c464ea7760f06_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"65⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"66⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"67⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"68⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"69⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"70⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"71⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"72⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"73⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"74⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"75⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"76⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"77⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"78⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"79⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"80⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"81⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"82⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"83⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"84⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"85⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"86⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"87⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"88⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"89⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"90⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"91⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"92⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"93⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"94⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"95⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"96⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"97⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"98⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"99⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"100⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"101⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"102⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"103⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"104⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"105⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"106⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"107⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"108⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"109⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"110⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"111⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"112⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"113⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"114⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"115⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"116⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"117⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"119⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"121⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-