Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe
-
Size
486KB
-
MD5
3723b0737c23ce23e307623c3d111cdb
-
SHA1
734f632f9a67357568e3dfa7e77a2e4f5dd43821
-
SHA256
dcc85459ed6deca10ce0712cc041188bd760b7a2da527613c8e05fe6cbd0da2d
-
SHA512
50a00f299a538aef3a9bcfd2a41a7e11e4c3c9d28b5a9dae71522eafe08cef15a8f33fa0f772629d25db4bda6809be6caf6762273469ba18695a314123c86de3
-
SSDEEP
12288:/U5rCOTeiDnr3O+O0jub8xIlmXtlSZNZ:/UQOJDnr38SubvsXuZN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1228 40C8.tmp 1384 4164.tmp 2680 426D.tmp 2856 4338.tmp 2804 4412.tmp 2904 44CD.tmp 2752 45B7.tmp 2748 4644.tmp 2580 470E.tmp 2652 479B.tmp 2996 4875.tmp 1700 4940.tmp 1044 4A1A.tmp 2868 4AB6.tmp 2288 4B72.tmp 1080 4C5C.tmp 1872 4D17.tmp 1048 4DB3.tmp 2044 4E9D.tmp 556 4F48.tmp 772 4FF4.tmp 1092 50BF.tmp 872 516A.tmp 760 51E7.tmp 1664 531F.tmp 2524 53CB.tmp 344 54B5.tmp 1804 5532.tmp 2364 55BE.tmp 2340 563B.tmp 2936 56B8.tmp 2076 5734.tmp 884 57B1.tmp 2416 584D.tmp 2032 58BA.tmp 632 5928.tmp 396 59A4.tmp 2400 5A12.tmp 1088 5A9E.tmp 2672 5AFC.tmp 1880 5B59.tmp 1904 5BD6.tmp 1392 5C62.tmp 1128 5CDF.tmp 2104 5D6C.tmp 1740 5DD9.tmp 3032 5E56.tmp 2952 5ED2.tmp 2068 5F4F.tmp 296 5FBC.tmp 1184 6039.tmp 1780 6097.tmp 1796 6123.tmp 2896 6181.tmp 1256 61EE.tmp 1976 625B.tmp 2892 62D8.tmp 1228 6326.tmp 2816 63B3.tmp 1384 6410.tmp 2812 648D.tmp 2700 64DB.tmp 2584 6548.tmp 2772 65C5.tmp -
Loads dropped DLL 64 IoCs
pid Process 1524 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 1228 40C8.tmp 1384 4164.tmp 2680 426D.tmp 2856 4338.tmp 2804 4412.tmp 2904 44CD.tmp 2752 45B7.tmp 2748 4644.tmp 2580 470E.tmp 2652 479B.tmp 2996 4875.tmp 1700 4940.tmp 1044 4A1A.tmp 2868 4AB6.tmp 2288 4B72.tmp 1080 4C5C.tmp 1872 4D17.tmp 1048 4DB3.tmp 2044 4E9D.tmp 556 4F48.tmp 772 4FF4.tmp 1092 50BF.tmp 872 516A.tmp 760 51E7.tmp 1664 531F.tmp 2524 53CB.tmp 344 54B5.tmp 1804 5532.tmp 2364 55BE.tmp 2340 563B.tmp 2936 56B8.tmp 2076 5734.tmp 884 57B1.tmp 2416 584D.tmp 2032 58BA.tmp 632 5928.tmp 396 59A4.tmp 2400 5A12.tmp 1088 5A9E.tmp 2672 5AFC.tmp 1880 5B59.tmp 1904 5BD6.tmp 1392 5C62.tmp 1128 5CDF.tmp 2104 5D6C.tmp 1740 5DD9.tmp 3032 5E56.tmp 2952 5ED2.tmp 2068 5F4F.tmp 296 5FBC.tmp 1184 6039.tmp 1780 6097.tmp 1796 6123.tmp 2896 6181.tmp 1256 61EE.tmp 1976 625B.tmp 2892 62D8.tmp 1228 6326.tmp 2816 63B3.tmp 1384 6410.tmp 2812 648D.tmp 2700 64DB.tmp 2584 6548.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1524 wrote to memory of 1228 1524 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 28 PID 1524 wrote to memory of 1228 1524 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 28 PID 1524 wrote to memory of 1228 1524 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 28 PID 1524 wrote to memory of 1228 1524 2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe 28 PID 1228 wrote to memory of 1384 1228 40C8.tmp 29 PID 1228 wrote to memory of 1384 1228 40C8.tmp 29 PID 1228 wrote to memory of 1384 1228 40C8.tmp 29 PID 1228 wrote to memory of 1384 1228 40C8.tmp 29 PID 1384 wrote to memory of 2680 1384 4164.tmp 30 PID 1384 wrote to memory of 2680 1384 4164.tmp 30 PID 1384 wrote to memory of 2680 1384 4164.tmp 30 PID 1384 wrote to memory of 2680 1384 4164.tmp 30 PID 2680 wrote to memory of 2856 2680 426D.tmp 31 PID 2680 wrote to memory of 2856 2680 426D.tmp 31 PID 2680 wrote to memory of 2856 2680 426D.tmp 31 PID 2680 wrote to memory of 2856 2680 426D.tmp 31 PID 2856 wrote to memory of 2804 2856 4338.tmp 32 PID 2856 wrote to memory of 2804 2856 4338.tmp 32 PID 2856 wrote to memory of 2804 2856 4338.tmp 32 PID 2856 wrote to memory of 2804 2856 4338.tmp 32 PID 2804 wrote to memory of 2904 2804 4412.tmp 33 PID 2804 wrote to memory of 2904 2804 4412.tmp 33 PID 2804 wrote to memory of 2904 2804 4412.tmp 33 PID 2804 wrote to memory of 2904 2804 4412.tmp 33 PID 2904 wrote to memory of 2752 2904 44CD.tmp 34 PID 2904 wrote to memory of 2752 2904 44CD.tmp 34 PID 2904 wrote to memory of 2752 2904 44CD.tmp 34 PID 2904 wrote to memory of 2752 2904 44CD.tmp 34 PID 2752 wrote to memory of 2748 2752 45B7.tmp 35 PID 2752 wrote to memory of 2748 2752 45B7.tmp 35 PID 2752 wrote to memory of 2748 2752 45B7.tmp 35 PID 2752 wrote to memory of 2748 2752 45B7.tmp 35 PID 2748 wrote to memory of 2580 2748 4644.tmp 36 PID 2748 wrote to memory of 2580 2748 4644.tmp 36 PID 2748 wrote to memory of 2580 2748 4644.tmp 36 PID 2748 wrote to memory of 2580 2748 4644.tmp 36 PID 2580 wrote to memory of 2652 2580 470E.tmp 37 PID 2580 wrote to memory of 2652 2580 470E.tmp 37 PID 2580 wrote to memory of 2652 2580 470E.tmp 37 PID 2580 wrote to memory of 2652 2580 470E.tmp 37 PID 2652 wrote to memory of 2996 2652 479B.tmp 38 PID 2652 wrote to memory of 2996 2652 479B.tmp 38 PID 2652 wrote to memory of 2996 2652 479B.tmp 38 PID 2652 wrote to memory of 2996 2652 479B.tmp 38 PID 2996 wrote to memory of 1700 2996 4875.tmp 39 PID 2996 wrote to memory of 1700 2996 4875.tmp 39 PID 2996 wrote to memory of 1700 2996 4875.tmp 39 PID 2996 wrote to memory of 1700 2996 4875.tmp 39 PID 1700 wrote to memory of 1044 1700 4940.tmp 40 PID 1700 wrote to memory of 1044 1700 4940.tmp 40 PID 1700 wrote to memory of 1044 1700 4940.tmp 40 PID 1700 wrote to memory of 1044 1700 4940.tmp 40 PID 1044 wrote to memory of 2868 1044 4A1A.tmp 41 PID 1044 wrote to memory of 2868 1044 4A1A.tmp 41 PID 1044 wrote to memory of 2868 1044 4A1A.tmp 41 PID 1044 wrote to memory of 2868 1044 4A1A.tmp 41 PID 2868 wrote to memory of 2288 2868 4AB6.tmp 42 PID 2868 wrote to memory of 2288 2868 4AB6.tmp 42 PID 2868 wrote to memory of 2288 2868 4AB6.tmp 42 PID 2868 wrote to memory of 2288 2868 4AB6.tmp 42 PID 2288 wrote to memory of 1080 2288 4B72.tmp 43 PID 2288 wrote to memory of 1080 2288 4B72.tmp 43 PID 2288 wrote to memory of 1080 2288 4B72.tmp 43 PID 2288 wrote to memory of 1080 2288 4B72.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-26_3723b0737c23ce23e307623c3d111cdb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\55BE.tmp"C:\Users\Admin\AppData\Local\Temp\55BE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\563B.tmp"C:\Users\Admin\AppData\Local\Temp\563B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5C62.tmp"C:\Users\Admin\AppData\Local\Temp\5C62.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"65⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"66⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"67⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"68⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"70⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"71⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"72⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"73⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"74⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"75⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"76⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"77⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"78⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"79⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"80⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"81⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"82⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"83⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"84⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"85⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"86⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"87⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"89⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"90⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"91⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"92⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\737B.tmp"C:\Users\Admin\AppData\Local\Temp\737B.tmp"93⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"94⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"95⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"96⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"97⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"98⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"99⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"101⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"103⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"104⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"105⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"108⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"109⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"110⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"111⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"112⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"113⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"115⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"116⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"117⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"118⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"119⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"120⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"121⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-