Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
-
Size
486KB
-
MD5
ca74206ded105ad061bd42ef07724e46
-
SHA1
c973034616008cc0b390887ea1891644b0bf001b
-
SHA256
f9855d3b41c64f1a8ea4239be885ca5f7814dcf50504cbc1212d94be94b8ba6b
-
SHA512
a59bb88e60671823855dc1667a41b3bbc5dc26f60d69a2c396a89585dc64b410fbf60a93df4fda0de083ee576e8df1bb9b037503e4115d814e009e2f71565058
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD780/U9FS1jmDUsyDdZaKTy03KEVe8narOigql:/U5rCOTeiDV/SwsUsETaIlK6e8hnoNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2300 53EA.tmp 2732 5467.tmp 2924 5560.tmp 2696 562B.tmp 2076 56C7.tmp 2624 57B1.tmp 2612 586C.tmp 2880 5918.tmp 2640 59E3.tmp 1052 5ACD.tmp 2572 5BF5.tmp 524 5D0E.tmp 2896 5DAA.tmp 2948 5E84.tmp 436 5F11.tmp 2656 5FAD.tmp 1856 6087.tmp 2264 61CF.tmp 1276 62A9.tmp 1640 6374.tmp 1516 647D.tmp 2788 6623.tmp 2824 66ED.tmp 308 677A.tmp 1968 6816.tmp 1472 6883.tmp 2096 690F.tmp 2684 698C.tmp 2468 6A09.tmp 3044 6A86.tmp 2452 6B12.tmp 2100 6B7F.tmp 1864 6BFC.tmp 2352 6C89.tmp 556 6CE6.tmp 836 6D63.tmp 2392 6DE0.tmp 1160 6E4D.tmp 1908 6EAB.tmp 1356 6F27.tmp 1572 6F95.tmp 1632 7040.tmp 1204 70BD.tmp 1840 713A.tmp 1056 71A7.tmp 880 7205.tmp 1380 7291.tmp 3008 72EF.tmp 272 735C.tmp 1316 73D9.tmp 2188 7455.tmp 1564 74C3.tmp 2000 755F.tmp 1716 75BC.tmp 1608 761A.tmp 2056 7687.tmp 2728 76E5.tmp 2300 7752.tmp 2864 77BF.tmp 2712 781D.tmp 2692 787A.tmp 2696 78F7.tmp 2704 7974.tmp 2888 79D1.tmp -
Loads dropped DLL 64 IoCs
pid Process 1208 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 2300 53EA.tmp 2732 5467.tmp 2924 5560.tmp 2696 562B.tmp 2076 56C7.tmp 2624 57B1.tmp 2612 586C.tmp 2880 5918.tmp 2640 59E3.tmp 1052 5ACD.tmp 2572 5BF5.tmp 524 5D0E.tmp 2896 5DAA.tmp 2948 5E84.tmp 436 5F11.tmp 2656 5FAD.tmp 1856 6087.tmp 2264 61CF.tmp 1276 62A9.tmp 1640 6374.tmp 1516 647D.tmp 2788 6623.tmp 2824 66ED.tmp 308 677A.tmp 1968 6816.tmp 1472 6883.tmp 2096 690F.tmp 2684 698C.tmp 2468 6A09.tmp 3044 6A86.tmp 2452 6B12.tmp 2100 6B7F.tmp 1864 6BFC.tmp 2352 6C89.tmp 556 6CE6.tmp 836 6D63.tmp 2392 6DE0.tmp 1160 6E4D.tmp 1908 6EAB.tmp 1356 6F27.tmp 1572 6F95.tmp 1632 7040.tmp 1204 70BD.tmp 1840 713A.tmp 1056 71A7.tmp 880 7205.tmp 1380 7291.tmp 3008 72EF.tmp 272 735C.tmp 1316 73D9.tmp 2188 7455.tmp 1564 74C3.tmp 2000 755F.tmp 1716 75BC.tmp 1608 761A.tmp 2056 7687.tmp 2728 76E5.tmp 2300 7752.tmp 2864 77BF.tmp 2712 781D.tmp 2692 787A.tmp 2696 78F7.tmp 2704 7974.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 2300 1208 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 28 PID 1208 wrote to memory of 2300 1208 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 28 PID 1208 wrote to memory of 2300 1208 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 28 PID 1208 wrote to memory of 2300 1208 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 28 PID 2300 wrote to memory of 2732 2300 53EA.tmp 29 PID 2300 wrote to memory of 2732 2300 53EA.tmp 29 PID 2300 wrote to memory of 2732 2300 53EA.tmp 29 PID 2300 wrote to memory of 2732 2300 53EA.tmp 29 PID 2732 wrote to memory of 2924 2732 5467.tmp 30 PID 2732 wrote to memory of 2924 2732 5467.tmp 30 PID 2732 wrote to memory of 2924 2732 5467.tmp 30 PID 2732 wrote to memory of 2924 2732 5467.tmp 30 PID 2924 wrote to memory of 2696 2924 5560.tmp 31 PID 2924 wrote to memory of 2696 2924 5560.tmp 31 PID 2924 wrote to memory of 2696 2924 5560.tmp 31 PID 2924 wrote to memory of 2696 2924 5560.tmp 31 PID 2696 wrote to memory of 2076 2696 562B.tmp 32 PID 2696 wrote to memory of 2076 2696 562B.tmp 32 PID 2696 wrote to memory of 2076 2696 562B.tmp 32 PID 2696 wrote to memory of 2076 2696 562B.tmp 32 PID 2076 wrote to memory of 2624 2076 56C7.tmp 33 PID 2076 wrote to memory of 2624 2076 56C7.tmp 33 PID 2076 wrote to memory of 2624 2076 56C7.tmp 33 PID 2076 wrote to memory of 2624 2076 56C7.tmp 33 PID 2624 wrote to memory of 2612 2624 57B1.tmp 34 PID 2624 wrote to memory of 2612 2624 57B1.tmp 34 PID 2624 wrote to memory of 2612 2624 57B1.tmp 34 PID 2624 wrote to memory of 2612 2624 57B1.tmp 34 PID 2612 wrote to memory of 2880 2612 586C.tmp 35 PID 2612 wrote to memory of 2880 2612 586C.tmp 35 PID 2612 wrote to memory of 2880 2612 586C.tmp 35 PID 2612 wrote to memory of 2880 2612 586C.tmp 35 PID 2880 wrote to memory of 2640 2880 5918.tmp 36 PID 2880 wrote to memory of 2640 2880 5918.tmp 36 PID 2880 wrote to memory of 2640 2880 5918.tmp 36 PID 2880 wrote to memory of 2640 2880 5918.tmp 36 PID 2640 wrote to memory of 1052 2640 59E3.tmp 37 PID 2640 wrote to memory of 1052 2640 59E3.tmp 37 PID 2640 wrote to memory of 1052 2640 59E3.tmp 37 PID 2640 wrote to memory of 1052 2640 59E3.tmp 37 PID 1052 wrote to memory of 2572 1052 5ACD.tmp 38 PID 1052 wrote to memory of 2572 1052 5ACD.tmp 38 PID 1052 wrote to memory of 2572 1052 5ACD.tmp 38 PID 1052 wrote to memory of 2572 1052 5ACD.tmp 38 PID 2572 wrote to memory of 524 2572 5BF5.tmp 39 PID 2572 wrote to memory of 524 2572 5BF5.tmp 39 PID 2572 wrote to memory of 524 2572 5BF5.tmp 39 PID 2572 wrote to memory of 524 2572 5BF5.tmp 39 PID 524 wrote to memory of 2896 524 5D0E.tmp 40 PID 524 wrote to memory of 2896 524 5D0E.tmp 40 PID 524 wrote to memory of 2896 524 5D0E.tmp 40 PID 524 wrote to memory of 2896 524 5D0E.tmp 40 PID 2896 wrote to memory of 2948 2896 5DAA.tmp 41 PID 2896 wrote to memory of 2948 2896 5DAA.tmp 41 PID 2896 wrote to memory of 2948 2896 5DAA.tmp 41 PID 2896 wrote to memory of 2948 2896 5DAA.tmp 41 PID 2948 wrote to memory of 436 2948 5E84.tmp 42 PID 2948 wrote to memory of 436 2948 5E84.tmp 42 PID 2948 wrote to memory of 436 2948 5E84.tmp 42 PID 2948 wrote to memory of 436 2948 5E84.tmp 42 PID 436 wrote to memory of 2656 436 5F11.tmp 43 PID 436 wrote to memory of 2656 436 5F11.tmp 43 PID 436 wrote to memory of 2656 436 5F11.tmp 43 PID 436 wrote to memory of 2656 436 5F11.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5467.tmp"C:\Users\Admin\AppData\Local\Temp\5467.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\62A9.tmp"C:\Users\Admin\AppData\Local\Temp\62A9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"65⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"66⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"67⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"68⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"70⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"71⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"72⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"74⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"75⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"76⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"77⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"78⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"79⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"80⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"81⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"82⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"83⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"84⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"85⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"87⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"88⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"89⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"90⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"91⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"92⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"93⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"94⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8881.tmp"C:\Users\Admin\AppData\Local\Temp\8881.tmp"95⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"96⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"97⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"98⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"99⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"100⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"101⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"102⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"103⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"104⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"105⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"106⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"107⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\8E99.tmp"C:\Users\Admin\AppData\Local\Temp\8E99.tmp"108⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"109⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"110⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"112⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"113⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\9231.tmp"C:\Users\Admin\AppData\Local\Temp\9231.tmp"115⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"116⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"117⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"118⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"119⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"120⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"121⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"122⤵PID:2192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-