Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe
-
Size
487KB
-
MD5
4549ae7e89f1d69c147e79b1d104abc5
-
SHA1
17079108641abf89eb10bbf912fae36cb7ffaa7e
-
SHA256
92c334d45e93ec8faaebf57d89ff3e62ee35bc5825184178b63ed76830222d2e
-
SHA512
be7478b3a5317d4cb4dac1afc8a2d5872746ddc2335ae2656abd64fdc46568f6707aa7cf4e2b07cc4e81e3e6c6a0f5f73ea48c09e091487b2d9fe1dea2fa60a2
-
SSDEEP
12288:HU5rCOTeiJ1wD1+kTEEJfP7sqE9oBFtNZ:HUQOJJ1s1ZT5srohN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2296 1584.tmp 2380 15E1.tmp 2544 164E.tmp 2580 16AC.tmp 2676 170A.tmp 2864 1777.tmp 2612 17D4.tmp 2800 1842.tmp 2684 18AF.tmp 2452 191C.tmp 2524 197A.tmp 3004 19E7.tmp 2208 1A44.tmp 2836 1AA2.tmp 2936 1B00.tmp 2952 1B6D.tmp 1548 1BDA.tmp 2752 1C47.tmp 404 1CA5.tmp 2840 1D02.tmp 1028 1D50.tmp 1196 1DBE.tmp 1368 1E1B.tmp 1304 1E5A.tmp 2400 1E98.tmp 1924 1ED6.tmp 2276 1F15.tmp 2432 1F53.tmp 1724 1F92.tmp 600 1FD0.tmp 1056 200E.tmp 1500 204D.tmp 1656 209B.tmp 1864 20D9.tmp 1808 2118.tmp 2424 2156.tmp 2156 2194.tmp 1108 21D3.tmp 1112 2211.tmp 1556 2250.tmp 1680 228E.tmp 960 22CC.tmp 280 230B.tmp 1832 2349.tmp 1840 2388.tmp 912 23C6.tmp 848 2414.tmp 1616 2452.tmp 2148 2491.tmp 2320 24CF.tmp 1712 251D.tmp 1508 255C.tmp 2028 259A.tmp 2404 25D8.tmp 1612 2617.tmp 764 2655.tmp 2204 2694.tmp 2852 26D2.tmp 2136 2710.tmp 1168 274F.tmp 2544 278D.tmp 2660 27CC.tmp 2604 280A.tmp 2712 2848.tmp -
Loads dropped DLL 64 IoCs
pid Process 3024 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 2296 1584.tmp 2380 15E1.tmp 2544 164E.tmp 2580 16AC.tmp 2676 170A.tmp 2864 1777.tmp 2612 17D4.tmp 2800 1842.tmp 2684 18AF.tmp 2452 191C.tmp 2524 197A.tmp 3004 19E7.tmp 2208 1A44.tmp 2836 1AA2.tmp 2936 1B00.tmp 2952 1B6D.tmp 1548 1BDA.tmp 2752 1C47.tmp 404 1CA5.tmp 2840 1D02.tmp 1028 1D50.tmp 1196 1DBE.tmp 1368 1E1B.tmp 1304 1E5A.tmp 2400 1E98.tmp 1924 1ED6.tmp 2276 1F15.tmp 2432 1F53.tmp 1724 1F92.tmp 600 1FD0.tmp 1056 200E.tmp 1500 204D.tmp 1656 209B.tmp 1864 20D9.tmp 1808 2118.tmp 2424 2156.tmp 2156 2194.tmp 1108 21D3.tmp 1112 2211.tmp 1556 2250.tmp 1680 228E.tmp 960 22CC.tmp 280 230B.tmp 1832 2349.tmp 1840 2388.tmp 912 23C6.tmp 848 2414.tmp 1616 2452.tmp 2148 2491.tmp 2320 24CF.tmp 1712 251D.tmp 1508 255C.tmp 2028 259A.tmp 2404 25D8.tmp 1612 2617.tmp 764 2655.tmp 2204 2694.tmp 2852 26D2.tmp 2136 2710.tmp 1168 274F.tmp 2544 278D.tmp 2660 27CC.tmp 2604 280A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2296 3024 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 28 PID 3024 wrote to memory of 2296 3024 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 28 PID 3024 wrote to memory of 2296 3024 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 28 PID 3024 wrote to memory of 2296 3024 2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe 28 PID 2296 wrote to memory of 2380 2296 1584.tmp 29 PID 2296 wrote to memory of 2380 2296 1584.tmp 29 PID 2296 wrote to memory of 2380 2296 1584.tmp 29 PID 2296 wrote to memory of 2380 2296 1584.tmp 29 PID 2380 wrote to memory of 2544 2380 15E1.tmp 30 PID 2380 wrote to memory of 2544 2380 15E1.tmp 30 PID 2380 wrote to memory of 2544 2380 15E1.tmp 30 PID 2380 wrote to memory of 2544 2380 15E1.tmp 30 PID 2544 wrote to memory of 2580 2544 164E.tmp 31 PID 2544 wrote to memory of 2580 2544 164E.tmp 31 PID 2544 wrote to memory of 2580 2544 164E.tmp 31 PID 2544 wrote to memory of 2580 2544 164E.tmp 31 PID 2580 wrote to memory of 2676 2580 16AC.tmp 32 PID 2580 wrote to memory of 2676 2580 16AC.tmp 32 PID 2580 wrote to memory of 2676 2580 16AC.tmp 32 PID 2580 wrote to memory of 2676 2580 16AC.tmp 32 PID 2676 wrote to memory of 2864 2676 170A.tmp 33 PID 2676 wrote to memory of 2864 2676 170A.tmp 33 PID 2676 wrote to memory of 2864 2676 170A.tmp 33 PID 2676 wrote to memory of 2864 2676 170A.tmp 33 PID 2864 wrote to memory of 2612 2864 1777.tmp 34 PID 2864 wrote to memory of 2612 2864 1777.tmp 34 PID 2864 wrote to memory of 2612 2864 1777.tmp 34 PID 2864 wrote to memory of 2612 2864 1777.tmp 34 PID 2612 wrote to memory of 2800 2612 17D4.tmp 35 PID 2612 wrote to memory of 2800 2612 17D4.tmp 35 PID 2612 wrote to memory of 2800 2612 17D4.tmp 35 PID 2612 wrote to memory of 2800 2612 17D4.tmp 35 PID 2800 wrote to memory of 2684 2800 1842.tmp 36 PID 2800 wrote to memory of 2684 2800 1842.tmp 36 PID 2800 wrote to memory of 2684 2800 1842.tmp 36 PID 2800 wrote to memory of 2684 2800 1842.tmp 36 PID 2684 wrote to memory of 2452 2684 18AF.tmp 37 PID 2684 wrote to memory of 2452 2684 18AF.tmp 37 PID 2684 wrote to memory of 2452 2684 18AF.tmp 37 PID 2684 wrote to memory of 2452 2684 18AF.tmp 37 PID 2452 wrote to memory of 2524 2452 191C.tmp 38 PID 2452 wrote to memory of 2524 2452 191C.tmp 38 PID 2452 wrote to memory of 2524 2452 191C.tmp 38 PID 2452 wrote to memory of 2524 2452 191C.tmp 38 PID 2524 wrote to memory of 3004 2524 197A.tmp 39 PID 2524 wrote to memory of 3004 2524 197A.tmp 39 PID 2524 wrote to memory of 3004 2524 197A.tmp 39 PID 2524 wrote to memory of 3004 2524 197A.tmp 39 PID 3004 wrote to memory of 2208 3004 19E7.tmp 40 PID 3004 wrote to memory of 2208 3004 19E7.tmp 40 PID 3004 wrote to memory of 2208 3004 19E7.tmp 40 PID 3004 wrote to memory of 2208 3004 19E7.tmp 40 PID 2208 wrote to memory of 2836 2208 1A44.tmp 41 PID 2208 wrote to memory of 2836 2208 1A44.tmp 41 PID 2208 wrote to memory of 2836 2208 1A44.tmp 41 PID 2208 wrote to memory of 2836 2208 1A44.tmp 41 PID 2836 wrote to memory of 2936 2836 1AA2.tmp 42 PID 2836 wrote to memory of 2936 2836 1AA2.tmp 42 PID 2836 wrote to memory of 2936 2836 1AA2.tmp 42 PID 2836 wrote to memory of 2936 2836 1AA2.tmp 42 PID 2936 wrote to memory of 2952 2936 1B00.tmp 43 PID 2936 wrote to memory of 2952 2936 1B00.tmp 43 PID 2936 wrote to memory of 2952 2936 1B00.tmp 43 PID 2936 wrote to memory of 2952 2936 1B00.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_4549ae7e89f1d69c147e79b1d104abc5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"65⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"66⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"67⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"68⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"69⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"71⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"72⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"73⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"74⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"75⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"76⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"77⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"78⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"79⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"80⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"81⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"83⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"84⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"85⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"86⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"88⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"89⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"90⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"91⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"92⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"94⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"95⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"96⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"97⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"98⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"99⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"100⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"101⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"102⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"103⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"104⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"106⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"107⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"108⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"110⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"111⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"112⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"113⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"114⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"115⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"116⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"117⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"119⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"120⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"121⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"122⤵PID:3044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-