Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe
-
Size
487KB
-
MD5
f461c370159eadb91c39cc5b942fe1b5
-
SHA1
ee2c4ce668445efe8d94c211c70876121a434f1a
-
SHA256
d675e0d7ee58dd3020c236e323a97d4472dd1add0483f4a227639337c987a10e
-
SHA512
aa00fac36936d46dccf8dd3a9b91c6d4ba94b5c23fe31798576804e425860eb946553c6176c21dbec2b96203e7e86caac0cdfaa747879aa37c3be68dbd2945aa
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxR6XnZbElL39CkdXN7lfrZcz9XsUF6Ajn8iN:yU5rCOTeiNf6XnV8LNCSX7tw5jn8DbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2188 C21.tmp 2368 C6F.tmp 2708 CDC.tmp 3060 D1B.tmp 2636 D69.tmp 2584 DA7.tmp 2592 DE6.tmp 2644 E34.tmp 2568 E91.tmp 2432 ED0.tmp 2504 F2D.tmp 2476 F7B.tmp 2316 FD9.tmp 2836 1027.tmp 2472 1065.tmp 2220 10A4.tmp 1632 1111.tmp 1640 114F.tmp 1752 11AD.tmp 1520 11FB.tmp 2752 1258.tmp 908 12A6.tmp 848 12E5.tmp 1204 1333.tmp 1760 1371.tmp 2056 13B0.tmp 1692 13EE.tmp 2216 142C.tmp 2000 146B.tmp 2880 149A.tmp 2052 14D8.tmp 776 1516.tmp 576 1555.tmp 1104 1593.tmp 1856 15D2.tmp 2252 1600.tmp 2020 163F.tmp 1812 167D.tmp 1160 16BC.tmp 2116 16FA.tmp 3048 1738.tmp 1544 1777.tmp 1336 17B5.tmp 944 17F4.tmp 1328 1822.tmp 2608 1861.tmp 928 1890.tmp 1844 18CE.tmp 1804 190C.tmp 600 194B.tmp 808 1989.tmp 1232 19C8.tmp 1508 1A06.tmp 2984 1A44.tmp 1592 1A83.tmp 1608 1AB2.tmp 2176 1AE0.tmp 2296 1B1F.tmp 2712 1B5D.tmp 2368 1B9C.tmp 3020 1BDA.tmp 2580 1C18.tmp 2572 1C57.tmp 2440 1C95.tmp -
Loads dropped DLL 64 IoCs
pid Process 2176 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 2188 C21.tmp 2368 C6F.tmp 2708 CDC.tmp 3060 D1B.tmp 2636 D69.tmp 2584 DA7.tmp 2592 DE6.tmp 2644 E34.tmp 2568 E91.tmp 2432 ED0.tmp 2504 F2D.tmp 2476 F7B.tmp 2316 FD9.tmp 2836 1027.tmp 2472 1065.tmp 2220 10A4.tmp 1632 1111.tmp 1640 114F.tmp 1752 11AD.tmp 1520 11FB.tmp 2752 1258.tmp 908 12A6.tmp 848 12E5.tmp 1204 1333.tmp 1760 1371.tmp 2056 13B0.tmp 1692 13EE.tmp 2216 142C.tmp 2000 146B.tmp 2880 149A.tmp 2052 14D8.tmp 776 1516.tmp 576 1555.tmp 1104 1593.tmp 1856 15D2.tmp 2252 1600.tmp 2020 163F.tmp 1812 167D.tmp 1160 16BC.tmp 2116 16FA.tmp 3048 1738.tmp 1544 1777.tmp 1336 17B5.tmp 944 17F4.tmp 1328 1822.tmp 2608 1861.tmp 928 1890.tmp 1844 18CE.tmp 1804 190C.tmp 600 194B.tmp 808 1989.tmp 1232 19C8.tmp 1508 1A06.tmp 2984 1A44.tmp 1592 1A83.tmp 1608 1AB2.tmp 2176 1AE0.tmp 2296 1B1F.tmp 2712 1B5D.tmp 2368 1B9C.tmp 3020 1BDA.tmp 2580 1C18.tmp 2572 1C57.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2188 2176 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 28 PID 2176 wrote to memory of 2188 2176 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 28 PID 2176 wrote to memory of 2188 2176 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 28 PID 2176 wrote to memory of 2188 2176 2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe 28 PID 2188 wrote to memory of 2368 2188 C21.tmp 87 PID 2188 wrote to memory of 2368 2188 C21.tmp 87 PID 2188 wrote to memory of 2368 2188 C21.tmp 87 PID 2188 wrote to memory of 2368 2188 C21.tmp 87 PID 2368 wrote to memory of 2708 2368 C6F.tmp 30 PID 2368 wrote to memory of 2708 2368 C6F.tmp 30 PID 2368 wrote to memory of 2708 2368 C6F.tmp 30 PID 2368 wrote to memory of 2708 2368 C6F.tmp 30 PID 2708 wrote to memory of 3060 2708 CDC.tmp 31 PID 2708 wrote to memory of 3060 2708 CDC.tmp 31 PID 2708 wrote to memory of 3060 2708 CDC.tmp 31 PID 2708 wrote to memory of 3060 2708 CDC.tmp 31 PID 3060 wrote to memory of 2636 3060 D1B.tmp 32 PID 3060 wrote to memory of 2636 3060 D1B.tmp 32 PID 3060 wrote to memory of 2636 3060 D1B.tmp 32 PID 3060 wrote to memory of 2636 3060 D1B.tmp 32 PID 2636 wrote to memory of 2584 2636 D69.tmp 33 PID 2636 wrote to memory of 2584 2636 D69.tmp 33 PID 2636 wrote to memory of 2584 2636 D69.tmp 33 PID 2636 wrote to memory of 2584 2636 D69.tmp 33 PID 2584 wrote to memory of 2592 2584 DA7.tmp 34 PID 2584 wrote to memory of 2592 2584 DA7.tmp 34 PID 2584 wrote to memory of 2592 2584 DA7.tmp 34 PID 2584 wrote to memory of 2592 2584 DA7.tmp 34 PID 2592 wrote to memory of 2644 2592 DE6.tmp 162 PID 2592 wrote to memory of 2644 2592 DE6.tmp 162 PID 2592 wrote to memory of 2644 2592 DE6.tmp 162 PID 2592 wrote to memory of 2644 2592 DE6.tmp 162 PID 2644 wrote to memory of 2568 2644 E34.tmp 97 PID 2644 wrote to memory of 2568 2644 E34.tmp 97 PID 2644 wrote to memory of 2568 2644 E34.tmp 97 PID 2644 wrote to memory of 2568 2644 E34.tmp 97 PID 2568 wrote to memory of 2432 2568 E91.tmp 37 PID 2568 wrote to memory of 2432 2568 E91.tmp 37 PID 2568 wrote to memory of 2432 2568 E91.tmp 37 PID 2568 wrote to memory of 2432 2568 E91.tmp 37 PID 2432 wrote to memory of 2504 2432 ED0.tmp 100 PID 2432 wrote to memory of 2504 2432 ED0.tmp 100 PID 2432 wrote to memory of 2504 2432 ED0.tmp 100 PID 2432 wrote to memory of 2504 2432 ED0.tmp 100 PID 2504 wrote to memory of 2476 2504 F2D.tmp 168 PID 2504 wrote to memory of 2476 2504 F2D.tmp 168 PID 2504 wrote to memory of 2476 2504 F2D.tmp 168 PID 2504 wrote to memory of 2476 2504 F2D.tmp 168 PID 2476 wrote to memory of 2316 2476 F7B.tmp 170 PID 2476 wrote to memory of 2316 2476 F7B.tmp 170 PID 2476 wrote to memory of 2316 2476 F7B.tmp 170 PID 2476 wrote to memory of 2316 2476 F7B.tmp 170 PID 2316 wrote to memory of 2836 2316 FD9.tmp 41 PID 2316 wrote to memory of 2836 2316 FD9.tmp 41 PID 2316 wrote to memory of 2836 2316 FD9.tmp 41 PID 2316 wrote to memory of 2836 2316 FD9.tmp 41 PID 2836 wrote to memory of 2472 2836 1027.tmp 173 PID 2836 wrote to memory of 2472 2836 1027.tmp 173 PID 2836 wrote to memory of 2472 2836 1027.tmp 173 PID 2836 wrote to memory of 2472 2836 1027.tmp 173 PID 2472 wrote to memory of 2220 2472 1065.tmp 43 PID 2472 wrote to memory of 2220 2472 1065.tmp 43 PID 2472 wrote to memory of 2220 2472 1065.tmp 43 PID 2472 wrote to memory of 2220 2472 1065.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_f461c370159eadb91c39cc5b942fe1b5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"65⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"66⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"68⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"69⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"70⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"71⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"72⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"73⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"74⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"75⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"76⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"77⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"79⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"80⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"81⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"82⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"83⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"84⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"86⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"87⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"88⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"89⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"90⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"91⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"92⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"93⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"94⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"95⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"96⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"97⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"99⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"100⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"101⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"102⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"103⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"104⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"105⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"106⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"107⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"108⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"109⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"110⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"111⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"112⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"113⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"115⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"116⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"117⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"119⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"120⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"121⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-