Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 23:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe
-
Size
520KB
-
MD5
606f51938e6b1b490ac03007dae689fd
-
SHA1
1ba7deb88344c42b64b15b76a827153575fe5cdd
-
SHA256
caece97f87f778f170aee43c9d50e32de2324ca3f370e822b66d35aa6bbb011a
-
SHA512
3f2a107b9e70cc1b771ecf244f5fb265c29ea57aeaa66e38e190a55870430e885934a861ebcf35bcabbf3ae274a27a043e0fe750c99695620cf4eebd277b2cb0
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLkYevmUToKm1cjNq2FCjgryVD6eyAs9jfpjQ6r:roRXOQjmOyUYevTozl2Ygczyn9D5NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1668 148A.tmp 2956 14E8.tmp 2976 1564.tmp 2656 15C2.tmp 2548 162F.tmp 2508 16AC.tmp 2772 170A.tmp 2556 1767.tmp 2392 17D4.tmp 2468 1851.tmp 2444 18BE.tmp 1552 193B.tmp 2368 19A8.tmp 2616 1A16.tmp 2620 1A73.tmp 1884 1AE0.tmp 1900 1B4E.tmp 812 1BAB.tmp 1588 1C09.tmp 2120 1C66.tmp 2136 1CD4.tmp 1452 1D22.tmp 1416 1D70.tmp 2896 1DBE.tmp 2892 1E0C.tmp 2196 1E69.tmp 320 1EB7.tmp 2184 1F05.tmp 3040 1F53.tmp 604 1F92.tmp 476 1FE0.tmp 580 201E.tmp 1436 206C.tmp 832 20AA.tmp 1432 20F8.tmp 2360 2137.tmp 2992 2185.tmp 2800 21C3.tmp 2948 2211.tmp 3064 2250.tmp 1464 228E.tmp 2352 22CC.tmp 1540 230B.tmp 1748 2359.tmp 1752 2397.tmp 876 23E5.tmp 624 2424.tmp 1652 2472.tmp 2264 24C0.tmp 3004 24FE.tmp 1180 254C.tmp 1264 259A.tmp 1908 25D8.tmp 2256 2617.tmp 1676 2665.tmp 1532 26A3.tmp 1520 26E2.tmp 2252 2730.tmp 2952 276E.tmp 2532 27CC.tmp 2540 280A.tmp 2676 2848.tmp 2796 2896.tmp 2400 28D5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2856 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 1668 148A.tmp 2956 14E8.tmp 2976 1564.tmp 2656 15C2.tmp 2548 162F.tmp 2508 16AC.tmp 2772 170A.tmp 2556 1767.tmp 2392 17D4.tmp 2468 1851.tmp 2444 18BE.tmp 1552 193B.tmp 2368 19A8.tmp 2616 1A16.tmp 2620 1A73.tmp 1884 1AE0.tmp 1900 1B4E.tmp 812 1BAB.tmp 1588 1C09.tmp 2120 1C66.tmp 2136 1CD4.tmp 1452 1D22.tmp 1416 1D70.tmp 2896 1DBE.tmp 2892 1E0C.tmp 2196 1E69.tmp 320 1EB7.tmp 2184 1F05.tmp 3040 1F53.tmp 604 1F92.tmp 476 1FE0.tmp 580 201E.tmp 1436 206C.tmp 832 20AA.tmp 1432 20F8.tmp 2360 2137.tmp 2992 2185.tmp 2800 21C3.tmp 2948 2211.tmp 3064 2250.tmp 1464 228E.tmp 2352 22CC.tmp 1540 230B.tmp 1748 2359.tmp 1752 2397.tmp 876 23E5.tmp 624 2424.tmp 1652 2472.tmp 2264 24C0.tmp 3004 24FE.tmp 1180 254C.tmp 1264 259A.tmp 1908 25D8.tmp 2256 2617.tmp 1676 2665.tmp 1532 26A3.tmp 1520 26E2.tmp 2252 2730.tmp 2952 276E.tmp 2532 27CC.tmp 2540 280A.tmp 2676 2848.tmp 2796 2896.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 1668 2856 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 28 PID 2856 wrote to memory of 1668 2856 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 28 PID 2856 wrote to memory of 1668 2856 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 28 PID 2856 wrote to memory of 1668 2856 2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe 28 PID 1668 wrote to memory of 2956 1668 148A.tmp 29 PID 1668 wrote to memory of 2956 1668 148A.tmp 29 PID 1668 wrote to memory of 2956 1668 148A.tmp 29 PID 1668 wrote to memory of 2956 1668 148A.tmp 29 PID 2956 wrote to memory of 2976 2956 14E8.tmp 30 PID 2956 wrote to memory of 2976 2956 14E8.tmp 30 PID 2956 wrote to memory of 2976 2956 14E8.tmp 30 PID 2956 wrote to memory of 2976 2956 14E8.tmp 30 PID 2976 wrote to memory of 2656 2976 1564.tmp 31 PID 2976 wrote to memory of 2656 2976 1564.tmp 31 PID 2976 wrote to memory of 2656 2976 1564.tmp 31 PID 2976 wrote to memory of 2656 2976 1564.tmp 31 PID 2656 wrote to memory of 2548 2656 15C2.tmp 32 PID 2656 wrote to memory of 2548 2656 15C2.tmp 32 PID 2656 wrote to memory of 2548 2656 15C2.tmp 32 PID 2656 wrote to memory of 2548 2656 15C2.tmp 32 PID 2548 wrote to memory of 2508 2548 162F.tmp 33 PID 2548 wrote to memory of 2508 2548 162F.tmp 33 PID 2548 wrote to memory of 2508 2548 162F.tmp 33 PID 2548 wrote to memory of 2508 2548 162F.tmp 33 PID 2508 wrote to memory of 2772 2508 16AC.tmp 34 PID 2508 wrote to memory of 2772 2508 16AC.tmp 34 PID 2508 wrote to memory of 2772 2508 16AC.tmp 34 PID 2508 wrote to memory of 2772 2508 16AC.tmp 34 PID 2772 wrote to memory of 2556 2772 170A.tmp 35 PID 2772 wrote to memory of 2556 2772 170A.tmp 35 PID 2772 wrote to memory of 2556 2772 170A.tmp 35 PID 2772 wrote to memory of 2556 2772 170A.tmp 35 PID 2556 wrote to memory of 2392 2556 1767.tmp 36 PID 2556 wrote to memory of 2392 2556 1767.tmp 36 PID 2556 wrote to memory of 2392 2556 1767.tmp 36 PID 2556 wrote to memory of 2392 2556 1767.tmp 36 PID 2392 wrote to memory of 2468 2392 17D4.tmp 37 PID 2392 wrote to memory of 2468 2392 17D4.tmp 37 PID 2392 wrote to memory of 2468 2392 17D4.tmp 37 PID 2392 wrote to memory of 2468 2392 17D4.tmp 37 PID 2468 wrote to memory of 2444 2468 1851.tmp 38 PID 2468 wrote to memory of 2444 2468 1851.tmp 38 PID 2468 wrote to memory of 2444 2468 1851.tmp 38 PID 2468 wrote to memory of 2444 2468 1851.tmp 38 PID 2444 wrote to memory of 1552 2444 18BE.tmp 39 PID 2444 wrote to memory of 1552 2444 18BE.tmp 39 PID 2444 wrote to memory of 1552 2444 18BE.tmp 39 PID 2444 wrote to memory of 1552 2444 18BE.tmp 39 PID 1552 wrote to memory of 2368 1552 193B.tmp 40 PID 1552 wrote to memory of 2368 1552 193B.tmp 40 PID 1552 wrote to memory of 2368 1552 193B.tmp 40 PID 1552 wrote to memory of 2368 1552 193B.tmp 40 PID 2368 wrote to memory of 2616 2368 19A8.tmp 41 PID 2368 wrote to memory of 2616 2368 19A8.tmp 41 PID 2368 wrote to memory of 2616 2368 19A8.tmp 41 PID 2368 wrote to memory of 2616 2368 19A8.tmp 41 PID 2616 wrote to memory of 2620 2616 1A16.tmp 42 PID 2616 wrote to memory of 2620 2616 1A16.tmp 42 PID 2616 wrote to memory of 2620 2616 1A16.tmp 42 PID 2616 wrote to memory of 2620 2616 1A16.tmp 42 PID 2620 wrote to memory of 1884 2620 1A73.tmp 43 PID 2620 wrote to memory of 1884 2620 1A73.tmp 43 PID 2620 wrote to memory of 1884 2620 1A73.tmp 43 PID 2620 wrote to memory of 1884 2620 1A73.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_606f51938e6b1b490ac03007dae689fd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"65⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"66⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"67⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"68⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"69⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"70⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"71⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"74⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"75⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"76⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"77⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"78⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"79⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"80⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"81⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"82⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"83⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"84⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"85⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"86⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"87⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"89⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"90⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"91⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"92⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"93⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"94⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"95⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"96⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"98⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"100⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"101⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"102⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"103⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"104⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"105⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"106⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"107⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"108⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"109⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"110⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"111⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"112⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"113⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"114⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"115⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"116⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"117⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"118⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"119⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"120⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"121⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"122⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-