Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe
-
Size
487KB
-
MD5
5e3a2db5e851bd9ad6f7771c70b36f99
-
SHA1
b603860bca317a1ab8333d90294ec9d9d0f5a021
-
SHA256
da2e5c1642a394a220fdce940891686985d5d2ebeb38a7fbf53d82cababc7aab
-
SHA512
eb46ec477712cdfb36c5f0c5c847f31951ddb4794e5403b52c2004472d1fa7d12a8e267f8429ef89152c2a3b938bc8d1f3813bbaf6fb81b9eb26b31ab3ead822
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUJfWPn9cjL5dVKC6vsvosGS5LsXrb115U9hJk:HU5rCOTeiJAePn27VKtvstD+n1kdiNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2932 1140.tmp 2156 118E.tmp 312 11FB.tmp 2040 1249.tmp 2640 12B6.tmp 2580 1314.tmp 2720 1381.tmp 2588 13DE.tmp 2456 143C.tmp 2540 14A9.tmp 2448 1507.tmp 2988 1564.tmp 1660 15E1.tmp 2824 163F.tmp 2964 168D.tmp 3012 16FA.tmp 1144 1758.tmp 2404 17A6.tmp 1808 1803.tmp 2672 1851.tmp 2680 18AF.tmp 2808 18FD.tmp 2060 194B.tmp 1524 1999.tmp 840 19E7.tmp 2100 1A25.tmp 1688 1A64.tmp 2796 1AA2.tmp 2356 1AE0.tmp 2912 1B2E.tmp 1196 1B6D.tmp 688 1BAB.tmp 1152 1BEA.tmp 1488 1C28.tmp 1108 1C66.tmp 1856 1CA5.tmp 1820 1CE3.tmp 2400 1D22.tmp 2028 1D60.tmp 1040 1D9E.tmp 2132 1DEC.tmp 1668 1E2B.tmp 1984 1E69.tmp 636 1EA8.tmp 2288 1EF6.tmp 1028 1F34.tmp 2268 1F72.tmp 2016 1FB1.tmp 1800 1FEF.tmp 1756 202E.tmp 656 206C.tmp 1676 20AA.tmp 2216 20E9.tmp 1580 2127.tmp 2228 2166.tmp 1592 21B4.tmp 1844 21F2.tmp 3048 2230.tmp 3056 226F.tmp 1752 22BD.tmp 2188 22FB.tmp 2376 233A.tmp 2120 2378.tmp 2628 23C6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2924 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 2932 1140.tmp 2156 118E.tmp 312 11FB.tmp 2040 1249.tmp 2640 12B6.tmp 2580 1314.tmp 2720 1381.tmp 2588 13DE.tmp 2456 143C.tmp 2540 14A9.tmp 2448 1507.tmp 2988 1564.tmp 1660 15E1.tmp 2824 163F.tmp 2964 168D.tmp 3012 16FA.tmp 1144 1758.tmp 2404 17A6.tmp 1808 1803.tmp 2672 1851.tmp 2680 18AF.tmp 2808 18FD.tmp 2060 194B.tmp 1524 1999.tmp 840 19E7.tmp 2100 1A25.tmp 1688 1A64.tmp 2796 1AA2.tmp 2356 1AE0.tmp 2912 1B2E.tmp 1196 1B6D.tmp 688 1BAB.tmp 1152 1BEA.tmp 1488 1C28.tmp 1108 1C66.tmp 1856 1CA5.tmp 1820 1CE3.tmp 2400 1D22.tmp 2028 1D60.tmp 1040 1D9E.tmp 2132 1DEC.tmp 1668 1E2B.tmp 1984 1E69.tmp 636 1EA8.tmp 2288 1EF6.tmp 1028 1F34.tmp 2268 1F72.tmp 2016 1FB1.tmp 1800 1FEF.tmp 1756 202E.tmp 656 206C.tmp 1676 20AA.tmp 2216 20E9.tmp 1580 2127.tmp 2228 2166.tmp 1592 21B4.tmp 1844 21F2.tmp 3048 2230.tmp 3056 226F.tmp 1752 22BD.tmp 2188 22FB.tmp 2376 233A.tmp 2120 2378.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2932 2924 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 28 PID 2924 wrote to memory of 2932 2924 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 28 PID 2924 wrote to memory of 2932 2924 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 28 PID 2924 wrote to memory of 2932 2924 2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe 28 PID 2932 wrote to memory of 2156 2932 1140.tmp 29 PID 2932 wrote to memory of 2156 2932 1140.tmp 29 PID 2932 wrote to memory of 2156 2932 1140.tmp 29 PID 2932 wrote to memory of 2156 2932 1140.tmp 29 PID 2156 wrote to memory of 312 2156 118E.tmp 30 PID 2156 wrote to memory of 312 2156 118E.tmp 30 PID 2156 wrote to memory of 312 2156 118E.tmp 30 PID 2156 wrote to memory of 312 2156 118E.tmp 30 PID 312 wrote to memory of 2040 312 11FB.tmp 31 PID 312 wrote to memory of 2040 312 11FB.tmp 31 PID 312 wrote to memory of 2040 312 11FB.tmp 31 PID 312 wrote to memory of 2040 312 11FB.tmp 31 PID 2040 wrote to memory of 2640 2040 1249.tmp 32 PID 2040 wrote to memory of 2640 2040 1249.tmp 32 PID 2040 wrote to memory of 2640 2040 1249.tmp 32 PID 2040 wrote to memory of 2640 2040 1249.tmp 32 PID 2640 wrote to memory of 2580 2640 12B6.tmp 33 PID 2640 wrote to memory of 2580 2640 12B6.tmp 33 PID 2640 wrote to memory of 2580 2640 12B6.tmp 33 PID 2640 wrote to memory of 2580 2640 12B6.tmp 33 PID 2580 wrote to memory of 2720 2580 1314.tmp 34 PID 2580 wrote to memory of 2720 2580 1314.tmp 34 PID 2580 wrote to memory of 2720 2580 1314.tmp 34 PID 2580 wrote to memory of 2720 2580 1314.tmp 34 PID 2720 wrote to memory of 2588 2720 1381.tmp 35 PID 2720 wrote to memory of 2588 2720 1381.tmp 35 PID 2720 wrote to memory of 2588 2720 1381.tmp 35 PID 2720 wrote to memory of 2588 2720 1381.tmp 35 PID 2588 wrote to memory of 2456 2588 13DE.tmp 36 PID 2588 wrote to memory of 2456 2588 13DE.tmp 36 PID 2588 wrote to memory of 2456 2588 13DE.tmp 36 PID 2588 wrote to memory of 2456 2588 13DE.tmp 36 PID 2456 wrote to memory of 2540 2456 143C.tmp 37 PID 2456 wrote to memory of 2540 2456 143C.tmp 37 PID 2456 wrote to memory of 2540 2456 143C.tmp 37 PID 2456 wrote to memory of 2540 2456 143C.tmp 37 PID 2540 wrote to memory of 2448 2540 14A9.tmp 38 PID 2540 wrote to memory of 2448 2540 14A9.tmp 38 PID 2540 wrote to memory of 2448 2540 14A9.tmp 38 PID 2540 wrote to memory of 2448 2540 14A9.tmp 38 PID 2448 wrote to memory of 2988 2448 1507.tmp 39 PID 2448 wrote to memory of 2988 2448 1507.tmp 39 PID 2448 wrote to memory of 2988 2448 1507.tmp 39 PID 2448 wrote to memory of 2988 2448 1507.tmp 39 PID 2988 wrote to memory of 1660 2988 1564.tmp 40 PID 2988 wrote to memory of 1660 2988 1564.tmp 40 PID 2988 wrote to memory of 1660 2988 1564.tmp 40 PID 2988 wrote to memory of 1660 2988 1564.tmp 40 PID 1660 wrote to memory of 2824 1660 15E1.tmp 41 PID 1660 wrote to memory of 2824 1660 15E1.tmp 41 PID 1660 wrote to memory of 2824 1660 15E1.tmp 41 PID 1660 wrote to memory of 2824 1660 15E1.tmp 41 PID 2824 wrote to memory of 2964 2824 163F.tmp 42 PID 2824 wrote to memory of 2964 2824 163F.tmp 42 PID 2824 wrote to memory of 2964 2824 163F.tmp 42 PID 2824 wrote to memory of 2964 2824 163F.tmp 42 PID 2964 wrote to memory of 3012 2964 168D.tmp 43 PID 2964 wrote to memory of 3012 2964 168D.tmp 43 PID 2964 wrote to memory of 3012 2964 168D.tmp 43 PID 2964 wrote to memory of 3012 2964 168D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_5e3a2db5e851bd9ad6f7771c70b36f99_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"65⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"66⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"67⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"68⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"69⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"70⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"71⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"72⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"73⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"74⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"75⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"76⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"78⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"79⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"80⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"81⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"82⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"83⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"84⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"85⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"86⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"87⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"88⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"89⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"90⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"92⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"93⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"94⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"95⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"96⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"97⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"98⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"99⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"100⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"101⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"102⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"103⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"104⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"105⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"106⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"107⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"108⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"109⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"110⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"111⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"112⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"113⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"115⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"116⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"117⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"118⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"119⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"120⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"121⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"122⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-