Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
-
Size
536KB
-
MD5
7f447ce89c4eab007d80d2c86b4bfc22
-
SHA1
ab17a879025ef32348477a15bda8435f9235f4fd
-
SHA256
d14bfe574efcbadd94b13d585275b46b49b4d149892cd72fd2c4bba2805c0e42
-
SHA512
aea404166b04348245167548472e0dac0f71ee73f0435abb4248d7e8d8a7e39a61194ac053e1782e81fa4ba390dbe7a1b7c8d90cf6944633ec8d3710ee8d91eb
-
SSDEEP
12288:wU5rCOTeiUDzmpma8+fSY5GFN1z4VBB+7d+IZxVJ0ZT9:wUQOJUDzmpZfSrC7B+YIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2840 27AC.tmp 2616 2839.tmp 2932 2896.tmp 2672 2913.tmp 2724 29AF.tmp 2728 2A1C.tmp 2608 2A8A.tmp 2432 2B35.tmp 2856 2BB2.tmp 2216 2C1F.tmp 820 2C8C.tmp 312 2D19.tmp 2040 2D86.tmp 1052 2E22.tmp 2220 2E8F.tmp 2044 2F2B.tmp 692 2FA8.tmp 1136 3034.tmp 2692 3092.tmp 1684 313E.tmp 2620 31AB.tmp 1264 3247.tmp 2416 32B4.tmp 1492 3331.tmp 2952 337F.tmp 1556 33CD.tmp 2392 341B.tmp 2972 3469.tmp 1044 34A7.tmp 860 3514.tmp 776 3553.tmp 1796 35C0.tmp 960 361E.tmp 1384 367B.tmp 1440 36BA.tmp 1728 3727.tmp 2172 3775.tmp 2116 37D2.tmp 2324 3820.tmp 2892 38EB.tmp 2060 3939.tmp 2616 3978.tmp 2576 39C6.tmp 2792 3A04.tmp 2192 3A52.tmp 2552 3AA0.tmp 2460 3AEE.tmp 2548 3B4C.tmp 2608 3B9A.tmp 2556 3BD8.tmp 2052 3C26.tmp 2856 3C64.tmp 2272 3CB2.tmp 320 3CF1.tmp 2008 3D2F.tmp 2496 3D7D.tmp 2412 3DBC.tmp 2200 3DFA.tmp 2204 3E48.tmp 2248 3E86.tmp 268 3ED4.tmp 336 3F13.tmp 1648 3F61.tmp 2336 3FAF.tmp -
Loads dropped DLL 64 IoCs
pid Process 2764 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 2840 27AC.tmp 2616 2839.tmp 2932 2896.tmp 2672 2913.tmp 2724 29AF.tmp 2728 2A1C.tmp 2608 2A8A.tmp 2432 2B35.tmp 2856 2BB2.tmp 2216 2C1F.tmp 820 2C8C.tmp 312 2D19.tmp 2040 2D86.tmp 1052 2E22.tmp 2220 2E8F.tmp 2044 2F2B.tmp 692 2FA8.tmp 1136 3034.tmp 2692 3092.tmp 1684 313E.tmp 2620 31AB.tmp 1264 3247.tmp 2416 32B4.tmp 1492 3331.tmp 2952 337F.tmp 1556 33CD.tmp 2392 341B.tmp 2972 3469.tmp 1044 34A7.tmp 860 3514.tmp 776 3553.tmp 1796 35C0.tmp 960 361E.tmp 1384 367B.tmp 1440 36BA.tmp 1728 3727.tmp 2172 3775.tmp 2116 37D2.tmp 2096 387E.tmp 2892 38EB.tmp 2060 3939.tmp 2616 3978.tmp 2576 39C6.tmp 2792 3A04.tmp 2192 3A52.tmp 2552 3AA0.tmp 2460 3AEE.tmp 2548 3B4C.tmp 2608 3B9A.tmp 2556 3BD8.tmp 2052 3C26.tmp 2856 3C64.tmp 2272 3CB2.tmp 320 3CF1.tmp 2008 3D2F.tmp 2496 3D7D.tmp 2412 3DBC.tmp 2200 3DFA.tmp 2204 3E48.tmp 2248 3E86.tmp 268 3ED4.tmp 336 3F13.tmp 1648 3F61.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2840 2764 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 28 PID 2764 wrote to memory of 2840 2764 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 28 PID 2764 wrote to memory of 2840 2764 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 28 PID 2764 wrote to memory of 2840 2764 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 28 PID 2840 wrote to memory of 2616 2840 27AC.tmp 29 PID 2840 wrote to memory of 2616 2840 27AC.tmp 29 PID 2840 wrote to memory of 2616 2840 27AC.tmp 29 PID 2840 wrote to memory of 2616 2840 27AC.tmp 29 PID 2616 wrote to memory of 2932 2616 2839.tmp 30 PID 2616 wrote to memory of 2932 2616 2839.tmp 30 PID 2616 wrote to memory of 2932 2616 2839.tmp 30 PID 2616 wrote to memory of 2932 2616 2839.tmp 30 PID 2932 wrote to memory of 2672 2932 2896.tmp 31 PID 2932 wrote to memory of 2672 2932 2896.tmp 31 PID 2932 wrote to memory of 2672 2932 2896.tmp 31 PID 2932 wrote to memory of 2672 2932 2896.tmp 31 PID 2672 wrote to memory of 2724 2672 2913.tmp 32 PID 2672 wrote to memory of 2724 2672 2913.tmp 32 PID 2672 wrote to memory of 2724 2672 2913.tmp 32 PID 2672 wrote to memory of 2724 2672 2913.tmp 32 PID 2724 wrote to memory of 2728 2724 29AF.tmp 33 PID 2724 wrote to memory of 2728 2724 29AF.tmp 33 PID 2724 wrote to memory of 2728 2724 29AF.tmp 33 PID 2724 wrote to memory of 2728 2724 29AF.tmp 33 PID 2728 wrote to memory of 2608 2728 2A1C.tmp 34 PID 2728 wrote to memory of 2608 2728 2A1C.tmp 34 PID 2728 wrote to memory of 2608 2728 2A1C.tmp 34 PID 2728 wrote to memory of 2608 2728 2A1C.tmp 34 PID 2608 wrote to memory of 2432 2608 2A8A.tmp 35 PID 2608 wrote to memory of 2432 2608 2A8A.tmp 35 PID 2608 wrote to memory of 2432 2608 2A8A.tmp 35 PID 2608 wrote to memory of 2432 2608 2A8A.tmp 35 PID 2432 wrote to memory of 2856 2432 2B35.tmp 36 PID 2432 wrote to memory of 2856 2432 2B35.tmp 36 PID 2432 wrote to memory of 2856 2432 2B35.tmp 36 PID 2432 wrote to memory of 2856 2432 2B35.tmp 36 PID 2856 wrote to memory of 2216 2856 2BB2.tmp 37 PID 2856 wrote to memory of 2216 2856 2BB2.tmp 37 PID 2856 wrote to memory of 2216 2856 2BB2.tmp 37 PID 2856 wrote to memory of 2216 2856 2BB2.tmp 37 PID 2216 wrote to memory of 820 2216 2C1F.tmp 38 PID 2216 wrote to memory of 820 2216 2C1F.tmp 38 PID 2216 wrote to memory of 820 2216 2C1F.tmp 38 PID 2216 wrote to memory of 820 2216 2C1F.tmp 38 PID 820 wrote to memory of 312 820 2C8C.tmp 39 PID 820 wrote to memory of 312 820 2C8C.tmp 39 PID 820 wrote to memory of 312 820 2C8C.tmp 39 PID 820 wrote to memory of 312 820 2C8C.tmp 39 PID 312 wrote to memory of 2040 312 2D19.tmp 40 PID 312 wrote to memory of 2040 312 2D19.tmp 40 PID 312 wrote to memory of 2040 312 2D19.tmp 40 PID 312 wrote to memory of 2040 312 2D19.tmp 40 PID 2040 wrote to memory of 1052 2040 2D86.tmp 41 PID 2040 wrote to memory of 1052 2040 2D86.tmp 41 PID 2040 wrote to memory of 1052 2040 2D86.tmp 41 PID 2040 wrote to memory of 1052 2040 2D86.tmp 41 PID 1052 wrote to memory of 2220 1052 2E22.tmp 42 PID 1052 wrote to memory of 2220 1052 2E22.tmp 42 PID 1052 wrote to memory of 2220 1052 2E22.tmp 42 PID 1052 wrote to memory of 2220 1052 2E22.tmp 42 PID 2220 wrote to memory of 2044 2220 2E8F.tmp 43 PID 2220 wrote to memory of 2044 2220 2E8F.tmp 43 PID 2220 wrote to memory of 2044 2220 2E8F.tmp 43 PID 2220 wrote to memory of 2044 2220 2E8F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"40⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"41⤵
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"66⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"67⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"68⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"69⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"70⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"71⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"72⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"73⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"74⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"75⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"76⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"77⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"78⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"79⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"80⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"81⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"82⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"83⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"84⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"85⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"86⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"87⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"88⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"89⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"90⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"91⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"92⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"93⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"94⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"95⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"96⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"97⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"98⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"99⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"100⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"102⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"103⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"104⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"105⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"106⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"107⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"108⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"109⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"112⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"113⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"115⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"116⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"117⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"118⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"119⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"120⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"121⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-