Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe
-
Size
536KB
-
MD5
de0982f5d366aff7d0042c3ed68a7252
-
SHA1
2d200576d42da9137765650852b67d5fa780e014
-
SHA256
d59973b2377435d84267fe133bad353f68c0bb15c2a473cd767967efd4ef2316
-
SHA512
e1ef24abf06458fc5a38838867b451d0f6cdb2e9dce12fd3ea4f1aa3e55550c49e6b4a633e002d218a391d55c5cc6a3409fb82a72ace8bae539162e8f5360869
-
SSDEEP
12288:wU5rCOTeiU9E62NW1KtpxdgfXuGIZxVJ0ZT9:wUQOJUSs1gdgfXlIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2372 1BDA.tmp 2796 1C57.tmp 2592 1D02.tmp 2816 1D8F.tmp 2308 1DEC.tmp 2696 1E5A.tmp 2492 1EA8.tmp 2464 1F53.tmp 2888 1FD0.tmp 1036 207C.tmp 2708 2108.tmp 2884 2175.tmp 2336 2202.tmp 2232 226F.tmp 1732 22CC.tmp 1644 233A.tmp 2228 23C6.tmp 860 2433.tmp 2300 24C0.tmp 2836 252D.tmp 2824 258A.tmp 540 25D8.tmp 1048 2636.tmp 1104 2694.tmp 3016 26F1.tmp 1816 273F.tmp 996 277E.tmp 2208 27CC.tmp 1068 280A.tmp 1688 2848.tmp 776 2896.tmp 1304 28D5.tmp 320 2913.tmp 2820 2980.tmp 1040 29CE.tmp 3004 2A1C.tmp 2848 2A6A.tmp 1000 2AB8.tmp 1744 2B06.tmp 2904 2B45.tmp 2920 2B83.tmp 2212 2BC2.tmp 3020 2C00.tmp 2644 2C3E.tmp 2552 2C7D.tmp 2808 2CCB.tmp 2776 2D09.tmp 2480 2D48.tmp 2584 2D86.tmp 2460 2DD4.tmp 2524 2E12.tmp 2284 2E60.tmp 2936 2EAE.tmp 2516 2EFC.tmp 2624 2F4A.tmp 3000 2FB8.tmp 2416 2FF6.tmp 1628 3034.tmp 2336 3082.tmp 1952 30D0.tmp 1940 310F.tmp 1632 315D.tmp 2504 319B.tmp 1444 31DA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2864 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 2372 1BDA.tmp 2796 1C57.tmp 2592 1D02.tmp 2816 1D8F.tmp 2308 1DEC.tmp 2696 1E5A.tmp 2492 1EA8.tmp 2464 1F53.tmp 2888 1FD0.tmp 1036 207C.tmp 2708 2108.tmp 2884 2175.tmp 2336 2202.tmp 2232 226F.tmp 1732 22CC.tmp 1644 233A.tmp 2228 23C6.tmp 860 2433.tmp 2300 24C0.tmp 2836 252D.tmp 2824 258A.tmp 540 25D8.tmp 1048 2636.tmp 1104 2694.tmp 3016 26F1.tmp 1816 273F.tmp 996 277E.tmp 2208 27CC.tmp 1068 280A.tmp 1688 2848.tmp 776 2896.tmp 1304 28D5.tmp 320 2913.tmp 2820 2980.tmp 1040 29CE.tmp 3004 2A1C.tmp 2848 2A6A.tmp 1000 2AB8.tmp 1744 2B06.tmp 2904 2B45.tmp 2920 2B83.tmp 2212 2BC2.tmp 3020 2C00.tmp 2644 2C3E.tmp 2552 2C7D.tmp 2808 2CCB.tmp 2776 2D09.tmp 2480 2D48.tmp 2584 2D86.tmp 2460 2DD4.tmp 2524 2E12.tmp 2284 2E60.tmp 2936 2EAE.tmp 2516 2EFC.tmp 2624 2F4A.tmp 3000 2FB8.tmp 2416 2FF6.tmp 1628 3034.tmp 2336 3082.tmp 1952 30D0.tmp 1940 310F.tmp 1632 315D.tmp 2504 319B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2372 2864 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 28 PID 2864 wrote to memory of 2372 2864 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 28 PID 2864 wrote to memory of 2372 2864 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 28 PID 2864 wrote to memory of 2372 2864 2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe 28 PID 2372 wrote to memory of 2796 2372 1BDA.tmp 29 PID 2372 wrote to memory of 2796 2372 1BDA.tmp 29 PID 2372 wrote to memory of 2796 2372 1BDA.tmp 29 PID 2372 wrote to memory of 2796 2372 1BDA.tmp 29 PID 2796 wrote to memory of 2592 2796 1C57.tmp 30 PID 2796 wrote to memory of 2592 2796 1C57.tmp 30 PID 2796 wrote to memory of 2592 2796 1C57.tmp 30 PID 2796 wrote to memory of 2592 2796 1C57.tmp 30 PID 2592 wrote to memory of 2816 2592 1D02.tmp 31 PID 2592 wrote to memory of 2816 2592 1D02.tmp 31 PID 2592 wrote to memory of 2816 2592 1D02.tmp 31 PID 2592 wrote to memory of 2816 2592 1D02.tmp 31 PID 2816 wrote to memory of 2308 2816 1D8F.tmp 32 PID 2816 wrote to memory of 2308 2816 1D8F.tmp 32 PID 2816 wrote to memory of 2308 2816 1D8F.tmp 32 PID 2816 wrote to memory of 2308 2816 1D8F.tmp 32 PID 2308 wrote to memory of 2696 2308 1DEC.tmp 33 PID 2308 wrote to memory of 2696 2308 1DEC.tmp 33 PID 2308 wrote to memory of 2696 2308 1DEC.tmp 33 PID 2308 wrote to memory of 2696 2308 1DEC.tmp 33 PID 2696 wrote to memory of 2492 2696 1E5A.tmp 34 PID 2696 wrote to memory of 2492 2696 1E5A.tmp 34 PID 2696 wrote to memory of 2492 2696 1E5A.tmp 34 PID 2696 wrote to memory of 2492 2696 1E5A.tmp 34 PID 2492 wrote to memory of 2464 2492 1EA8.tmp 35 PID 2492 wrote to memory of 2464 2492 1EA8.tmp 35 PID 2492 wrote to memory of 2464 2492 1EA8.tmp 35 PID 2492 wrote to memory of 2464 2492 1EA8.tmp 35 PID 2464 wrote to memory of 2888 2464 1F53.tmp 36 PID 2464 wrote to memory of 2888 2464 1F53.tmp 36 PID 2464 wrote to memory of 2888 2464 1F53.tmp 36 PID 2464 wrote to memory of 2888 2464 1F53.tmp 36 PID 2888 wrote to memory of 1036 2888 1FD0.tmp 37 PID 2888 wrote to memory of 1036 2888 1FD0.tmp 37 PID 2888 wrote to memory of 1036 2888 1FD0.tmp 37 PID 2888 wrote to memory of 1036 2888 1FD0.tmp 37 PID 1036 wrote to memory of 2708 1036 207C.tmp 38 PID 1036 wrote to memory of 2708 1036 207C.tmp 38 PID 1036 wrote to memory of 2708 1036 207C.tmp 38 PID 1036 wrote to memory of 2708 1036 207C.tmp 38 PID 2708 wrote to memory of 2884 2708 2108.tmp 39 PID 2708 wrote to memory of 2884 2708 2108.tmp 39 PID 2708 wrote to memory of 2884 2708 2108.tmp 39 PID 2708 wrote to memory of 2884 2708 2108.tmp 39 PID 2884 wrote to memory of 2336 2884 2175.tmp 40 PID 2884 wrote to memory of 2336 2884 2175.tmp 40 PID 2884 wrote to memory of 2336 2884 2175.tmp 40 PID 2884 wrote to memory of 2336 2884 2175.tmp 40 PID 2336 wrote to memory of 2232 2336 2202.tmp 41 PID 2336 wrote to memory of 2232 2336 2202.tmp 41 PID 2336 wrote to memory of 2232 2336 2202.tmp 41 PID 2336 wrote to memory of 2232 2336 2202.tmp 41 PID 2232 wrote to memory of 1732 2232 226F.tmp 42 PID 2232 wrote to memory of 1732 2232 226F.tmp 42 PID 2232 wrote to memory of 1732 2232 226F.tmp 42 PID 2232 wrote to memory of 1732 2232 226F.tmp 42 PID 1732 wrote to memory of 1644 1732 22CC.tmp 43 PID 1732 wrote to memory of 1644 1732 22CC.tmp 43 PID 1732 wrote to memory of 1644 1732 22CC.tmp 43 PID 1732 wrote to memory of 1644 1732 22CC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_de0982f5d366aff7d0042c3ed68a7252_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"65⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"66⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"67⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"68⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"69⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"70⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"71⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"72⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"73⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"74⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"75⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"76⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"77⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"78⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"79⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"80⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"81⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"82⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"83⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"84⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"85⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"86⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"87⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"88⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"89⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"90⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"91⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"92⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"93⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"94⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"95⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"96⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"97⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"98⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"99⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"100⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"101⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"102⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"103⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"105⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"106⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"107⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"108⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"109⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"110⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"111⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"112⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"113⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"114⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"115⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"116⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"117⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"118⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"119⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"120⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"121⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"122⤵PID:1288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-