Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe
-
Size
527KB
-
MD5
3a0c47563b13918fdbd805cd8d96bf17
-
SHA1
8fd0cad9f7c0bea7648a550510f322b1506b618b
-
SHA256
37d0a54e37ded1cc99ddf7aa71a6630786840016064b3b24469317af81f005f7
-
SHA512
1f8f0ec2262ba352a56221213fcc170095d7cd7ffbae3f84be710c1a55cec06d12b932a053c1e304faab17ab82ad3112434a62de313c4bdae904a478cc7b8ae5
-
SSDEEP
12288:fU5rCOTeid4T4Gd3ENo9ccn3PMzozLpKbEu7DZu:fUQOJdxG8o9Z3Pqoz9zkDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2424 1065.tmp 2664 10E2.tmp 2680 119D.tmp 2780 120A.tmp 2728 12A6.tmp 2704 1352.tmp 2604 13BF.tmp 2284 143C.tmp 1976 14C8.tmp 2620 1564.tmp 1420 15B2.tmp 2584 163F.tmp 3068 16DB.tmp 2316 1777.tmp 2264 1813.tmp 1312 18AF.tmp 1596 194B.tmp 2792 19B8.tmp 1872 19F6.tmp 1900 1A83.tmp 2964 1AC1.tmp 1512 1B3E.tmp 2268 1BCA.tmp 1492 1C28.tmp 2520 1C76.tmp 1876 1CC4.tmp 2076 1D12.tmp 3024 1D50.tmp 2400 1D9E.tmp 2548 1DDD.tmp 668 1E2B.tmp 756 1E69.tmp 888 1EA8.tmp 2308 1EF6.tmp 584 1F44.tmp 344 1F82.tmp 1528 1FD0.tmp 3028 201E.tmp 1160 205C.tmp 2280 209B.tmp 2128 20E9.tmp 1896 2137.tmp 1648 2185.tmp 1332 21E2.tmp 1328 2230.tmp 1640 227E.tmp 900 22CC.tmp 564 231A.tmp 2488 2359.tmp 2328 23A7.tmp 1828 2404.tmp 1952 2443.tmp 884 2491.tmp 1124 24CF.tmp 2088 251D.tmp 2436 255C.tmp 1548 25AA.tmp 1572 25E8.tmp 2160 2626.tmp 2044 2674.tmp 2920 26B3.tmp 2768 2701.tmp 2724 273F.tmp 2872 277E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2360 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 2424 1065.tmp 2664 10E2.tmp 2680 119D.tmp 2780 120A.tmp 2728 12A6.tmp 2704 1352.tmp 2604 13BF.tmp 2284 143C.tmp 1976 14C8.tmp 2620 1564.tmp 1420 15B2.tmp 2584 163F.tmp 3068 16DB.tmp 2316 1777.tmp 2264 1813.tmp 1312 18AF.tmp 1596 194B.tmp 2792 19B8.tmp 1872 19F6.tmp 1900 1A83.tmp 2964 1AC1.tmp 1512 1B3E.tmp 2268 1BCA.tmp 1492 1C28.tmp 2520 1C76.tmp 1876 1CC4.tmp 2076 1D12.tmp 3024 1D50.tmp 2400 1D9E.tmp 2548 1DDD.tmp 668 1E2B.tmp 756 1E69.tmp 888 1EA8.tmp 2308 1EF6.tmp 584 1F44.tmp 344 1F82.tmp 1528 1FD0.tmp 3028 201E.tmp 1160 205C.tmp 2280 209B.tmp 2128 20E9.tmp 1896 2137.tmp 1648 2185.tmp 1332 21E2.tmp 1328 2230.tmp 1640 227E.tmp 900 22CC.tmp 564 231A.tmp 2488 2359.tmp 2328 23A7.tmp 1828 2404.tmp 1952 2443.tmp 884 2491.tmp 1124 24CF.tmp 2088 251D.tmp 2436 255C.tmp 1548 25AA.tmp 1572 25E8.tmp 2160 2626.tmp 2044 2674.tmp 2920 26B3.tmp 2768 2701.tmp 2724 273F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2424 2360 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 28 PID 2360 wrote to memory of 2424 2360 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 28 PID 2360 wrote to memory of 2424 2360 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 28 PID 2360 wrote to memory of 2424 2360 2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe 28 PID 2424 wrote to memory of 2664 2424 1065.tmp 29 PID 2424 wrote to memory of 2664 2424 1065.tmp 29 PID 2424 wrote to memory of 2664 2424 1065.tmp 29 PID 2424 wrote to memory of 2664 2424 1065.tmp 29 PID 2664 wrote to memory of 2680 2664 10E2.tmp 30 PID 2664 wrote to memory of 2680 2664 10E2.tmp 30 PID 2664 wrote to memory of 2680 2664 10E2.tmp 30 PID 2664 wrote to memory of 2680 2664 10E2.tmp 30 PID 2680 wrote to memory of 2780 2680 119D.tmp 31 PID 2680 wrote to memory of 2780 2680 119D.tmp 31 PID 2680 wrote to memory of 2780 2680 119D.tmp 31 PID 2680 wrote to memory of 2780 2680 119D.tmp 31 PID 2780 wrote to memory of 2728 2780 120A.tmp 32 PID 2780 wrote to memory of 2728 2780 120A.tmp 32 PID 2780 wrote to memory of 2728 2780 120A.tmp 32 PID 2780 wrote to memory of 2728 2780 120A.tmp 32 PID 2728 wrote to memory of 2704 2728 12A6.tmp 33 PID 2728 wrote to memory of 2704 2728 12A6.tmp 33 PID 2728 wrote to memory of 2704 2728 12A6.tmp 33 PID 2728 wrote to memory of 2704 2728 12A6.tmp 33 PID 2704 wrote to memory of 2604 2704 1352.tmp 34 PID 2704 wrote to memory of 2604 2704 1352.tmp 34 PID 2704 wrote to memory of 2604 2704 1352.tmp 34 PID 2704 wrote to memory of 2604 2704 1352.tmp 34 PID 2604 wrote to memory of 2284 2604 13BF.tmp 35 PID 2604 wrote to memory of 2284 2604 13BF.tmp 35 PID 2604 wrote to memory of 2284 2604 13BF.tmp 35 PID 2604 wrote to memory of 2284 2604 13BF.tmp 35 PID 2284 wrote to memory of 1976 2284 143C.tmp 36 PID 2284 wrote to memory of 1976 2284 143C.tmp 36 PID 2284 wrote to memory of 1976 2284 143C.tmp 36 PID 2284 wrote to memory of 1976 2284 143C.tmp 36 PID 1976 wrote to memory of 2620 1976 14C8.tmp 37 PID 1976 wrote to memory of 2620 1976 14C8.tmp 37 PID 1976 wrote to memory of 2620 1976 14C8.tmp 37 PID 1976 wrote to memory of 2620 1976 14C8.tmp 37 PID 2620 wrote to memory of 1420 2620 1564.tmp 38 PID 2620 wrote to memory of 1420 2620 1564.tmp 38 PID 2620 wrote to memory of 1420 2620 1564.tmp 38 PID 2620 wrote to memory of 1420 2620 1564.tmp 38 PID 1420 wrote to memory of 2584 1420 15B2.tmp 39 PID 1420 wrote to memory of 2584 1420 15B2.tmp 39 PID 1420 wrote to memory of 2584 1420 15B2.tmp 39 PID 1420 wrote to memory of 2584 1420 15B2.tmp 39 PID 2584 wrote to memory of 3068 2584 163F.tmp 40 PID 2584 wrote to memory of 3068 2584 163F.tmp 40 PID 2584 wrote to memory of 3068 2584 163F.tmp 40 PID 2584 wrote to memory of 3068 2584 163F.tmp 40 PID 3068 wrote to memory of 2316 3068 16DB.tmp 41 PID 3068 wrote to memory of 2316 3068 16DB.tmp 41 PID 3068 wrote to memory of 2316 3068 16DB.tmp 41 PID 3068 wrote to memory of 2316 3068 16DB.tmp 41 PID 2316 wrote to memory of 2264 2316 1777.tmp 42 PID 2316 wrote to memory of 2264 2316 1777.tmp 42 PID 2316 wrote to memory of 2264 2316 1777.tmp 42 PID 2316 wrote to memory of 2264 2316 1777.tmp 42 PID 2264 wrote to memory of 1312 2264 1813.tmp 43 PID 2264 wrote to memory of 1312 2264 1813.tmp 43 PID 2264 wrote to memory of 1312 2264 1813.tmp 43 PID 2264 wrote to memory of 1312 2264 1813.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_3a0c47563b13918fdbd805cd8d96bf17_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"65⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"66⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"67⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"70⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"71⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"72⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"73⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"74⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"75⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"77⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"78⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"79⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"80⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"82⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"83⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"84⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"85⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"86⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"87⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"88⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"89⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"90⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"91⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"92⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"93⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"94⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"95⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"96⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"97⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"98⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"99⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"100⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"101⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"102⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"104⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"105⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"106⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"107⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"108⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"109⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"110⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"111⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"112⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"113⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"115⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"116⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"117⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"118⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"119⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"120⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"121⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-