Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe
-
Size
527KB
-
MD5
ce5eff8254dc01a29d78c413d2c39633
-
SHA1
adf21f26607f8ccfc71992ae35c07f14752f6610
-
SHA256
28555ab13233641b7bdb2160fdc399ca0b136ba5aebe48d38ebd9ac7ca4c8354
-
SHA512
77c0a04a1a1dc6c1c4bb780c16cefbefd42dfb7c7c38084279a3cea5cf807ae539b2f174f3e128bd4d6c6adfdfb3ec910c82ac1ed4f9cd391fb46ee58440279b
-
SSDEEP
12288:fU5rCOTeidfytT/KG1HBmpGb3pKV/6DZu:fUQOJdaj1hsGMJ6Do
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1580 31E9.tmp 2560 3256.tmp 2416 32D3.tmp 2752 3340.tmp 2904 338E.tmp 2748 33FC.tmp 2492 3469.tmp 2640 34E6.tmp 2460 3553.tmp 2588 35C0.tmp 2420 360E.tmp 1236 367B.tmp 2860 36D9.tmp 2808 3756.tmp 2668 37C3.tmp 1636 3830.tmp 1240 38BC.tmp 756 3939.tmp 1828 3997.tmp 484 3A14.tmp 2776 3A81.tmp 2676 3AEE.tmp 1008 3B4C.tmp 2044 3B9A.tmp 2024 3BD8.tmp 2196 3C16.tmp 2308 3C55.tmp 1892 3CA3.tmp 1092 3CE1.tmp 2644 3D2F.tmp 1088 3D6E.tmp 2056 3DBC.tmp 2928 3DFA.tmp 1072 3E38.tmp 896 3E77.tmp 1176 3EB5.tmp 448 3F03.tmp 2300 3F51.tmp 820 3F90.tmp 1844 3FDE.tmp 2912 401C.tmp 1308 405A.tmp 344 4099.tmp 3056 40D7.tmp 856 4116.tmp 1588 4164.tmp 600 41A2.tmp 2552 41E0.tmp 2128 421F.tmp 2216 425D.tmp 1576 429C.tmp 880 42DA.tmp 340 4318.tmp 1700 4357.tmp 1480 4395.tmp 1508 43D4.tmp 3044 4412.tmp 2380 4460.tmp 2288 449E.tmp 2696 44EC.tmp 1620 452B.tmp 2752 4579.tmp 2900 45B7.tmp 2904 45F6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2104 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 1580 31E9.tmp 2560 3256.tmp 2416 32D3.tmp 2752 3340.tmp 2904 338E.tmp 2748 33FC.tmp 2492 3469.tmp 2640 34E6.tmp 2460 3553.tmp 2588 35C0.tmp 2420 360E.tmp 1236 367B.tmp 2860 36D9.tmp 2808 3756.tmp 2668 37C3.tmp 1636 3830.tmp 1240 38BC.tmp 756 3939.tmp 1828 3997.tmp 484 3A14.tmp 2776 3A81.tmp 2676 3AEE.tmp 1008 3B4C.tmp 2044 3B9A.tmp 2024 3BD8.tmp 2196 3C16.tmp 2308 3C55.tmp 1892 3CA3.tmp 1092 3CE1.tmp 2644 3D2F.tmp 1088 3D6E.tmp 2056 3DBC.tmp 2928 3DFA.tmp 1072 3E38.tmp 896 3E77.tmp 1176 3EB5.tmp 448 3F03.tmp 2300 3F51.tmp 820 3F90.tmp 1844 3FDE.tmp 2912 401C.tmp 1308 405A.tmp 344 4099.tmp 3056 40D7.tmp 856 4116.tmp 1588 4164.tmp 600 41A2.tmp 2552 41E0.tmp 2128 421F.tmp 2216 425D.tmp 1576 429C.tmp 880 42DA.tmp 340 4318.tmp 1700 4357.tmp 1480 4395.tmp 1508 43D4.tmp 3044 4412.tmp 2380 4460.tmp 2288 449E.tmp 2696 44EC.tmp 1620 452B.tmp 2752 4579.tmp 2900 45B7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1580 2104 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 28 PID 2104 wrote to memory of 1580 2104 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 28 PID 2104 wrote to memory of 1580 2104 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 28 PID 2104 wrote to memory of 1580 2104 2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe 28 PID 1580 wrote to memory of 2560 1580 31E9.tmp 29 PID 1580 wrote to memory of 2560 1580 31E9.tmp 29 PID 1580 wrote to memory of 2560 1580 31E9.tmp 29 PID 1580 wrote to memory of 2560 1580 31E9.tmp 29 PID 2560 wrote to memory of 2416 2560 3256.tmp 30 PID 2560 wrote to memory of 2416 2560 3256.tmp 30 PID 2560 wrote to memory of 2416 2560 3256.tmp 30 PID 2560 wrote to memory of 2416 2560 3256.tmp 30 PID 2416 wrote to memory of 2752 2416 32D3.tmp 31 PID 2416 wrote to memory of 2752 2416 32D3.tmp 31 PID 2416 wrote to memory of 2752 2416 32D3.tmp 31 PID 2416 wrote to memory of 2752 2416 32D3.tmp 31 PID 2752 wrote to memory of 2904 2752 3340.tmp 32 PID 2752 wrote to memory of 2904 2752 3340.tmp 32 PID 2752 wrote to memory of 2904 2752 3340.tmp 32 PID 2752 wrote to memory of 2904 2752 3340.tmp 32 PID 2904 wrote to memory of 2748 2904 338E.tmp 33 PID 2904 wrote to memory of 2748 2904 338E.tmp 33 PID 2904 wrote to memory of 2748 2904 338E.tmp 33 PID 2904 wrote to memory of 2748 2904 338E.tmp 33 PID 2748 wrote to memory of 2492 2748 33FC.tmp 34 PID 2748 wrote to memory of 2492 2748 33FC.tmp 34 PID 2748 wrote to memory of 2492 2748 33FC.tmp 34 PID 2748 wrote to memory of 2492 2748 33FC.tmp 34 PID 2492 wrote to memory of 2640 2492 3469.tmp 35 PID 2492 wrote to memory of 2640 2492 3469.tmp 35 PID 2492 wrote to memory of 2640 2492 3469.tmp 35 PID 2492 wrote to memory of 2640 2492 3469.tmp 35 PID 2640 wrote to memory of 2460 2640 34E6.tmp 36 PID 2640 wrote to memory of 2460 2640 34E6.tmp 36 PID 2640 wrote to memory of 2460 2640 34E6.tmp 36 PID 2640 wrote to memory of 2460 2640 34E6.tmp 36 PID 2460 wrote to memory of 2588 2460 3553.tmp 37 PID 2460 wrote to memory of 2588 2460 3553.tmp 37 PID 2460 wrote to memory of 2588 2460 3553.tmp 37 PID 2460 wrote to memory of 2588 2460 3553.tmp 37 PID 2588 wrote to memory of 2420 2588 35C0.tmp 38 PID 2588 wrote to memory of 2420 2588 35C0.tmp 38 PID 2588 wrote to memory of 2420 2588 35C0.tmp 38 PID 2588 wrote to memory of 2420 2588 35C0.tmp 38 PID 2420 wrote to memory of 1236 2420 360E.tmp 39 PID 2420 wrote to memory of 1236 2420 360E.tmp 39 PID 2420 wrote to memory of 1236 2420 360E.tmp 39 PID 2420 wrote to memory of 1236 2420 360E.tmp 39 PID 1236 wrote to memory of 2860 1236 367B.tmp 40 PID 1236 wrote to memory of 2860 1236 367B.tmp 40 PID 1236 wrote to memory of 2860 1236 367B.tmp 40 PID 1236 wrote to memory of 2860 1236 367B.tmp 40 PID 2860 wrote to memory of 2808 2860 36D9.tmp 41 PID 2860 wrote to memory of 2808 2860 36D9.tmp 41 PID 2860 wrote to memory of 2808 2860 36D9.tmp 41 PID 2860 wrote to memory of 2808 2860 36D9.tmp 41 PID 2808 wrote to memory of 2668 2808 3756.tmp 42 PID 2808 wrote to memory of 2668 2808 3756.tmp 42 PID 2808 wrote to memory of 2668 2808 3756.tmp 42 PID 2808 wrote to memory of 2668 2808 3756.tmp 42 PID 2668 wrote to memory of 1636 2668 37C3.tmp 43 PID 2668 wrote to memory of 1636 2668 37C3.tmp 43 PID 2668 wrote to memory of 1636 2668 37C3.tmp 43 PID 2668 wrote to memory of 1636 2668 37C3.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_ce5eff8254dc01a29d78c413d2c39633_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"65⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"67⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"68⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"69⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"70⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"71⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"72⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"73⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"74⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"75⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"76⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"77⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"78⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"79⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\49DC.tmp"C:\Users\Admin\AppData\Local\Temp\49DC.tmp"80⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"81⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"82⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"83⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"84⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"85⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"86⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"87⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"88⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"89⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"92⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"93⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"94⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"95⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"96⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"97⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"98⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"99⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"100⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"101⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"102⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"103⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"104⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"106⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"107⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"108⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"109⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"110⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"111⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"112⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"113⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"115⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"116⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"117⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"118⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"119⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"120⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\5467.tmp"C:\Users\Admin\AppData\Local\Temp\5467.tmp"121⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\54A5.tmp"C:\Users\Admin\AppData\Local\Temp\54A5.tmp"122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-