Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe
-
Size
487KB
-
MD5
37f7c693ee3c9a698de76bcaa7175016
-
SHA1
809812568d1a5bddc17f7e3f33fd66593a357705
-
SHA256
f11d8c66bf370a4282ae7cf935d1999f2d1b918b3d6e41105dc5719282607f20
-
SHA512
1b5c815a0fc1519ddced9622425a74f601fae660387337ae4fa4246dd03890bf3220de94d1fb3bb14f41d3ae1d5686f9fc971a08011ed744e8123f3ad56545a6
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUHAhMf3LaMD7U8IfoU3ayVz6/Ec4wVEJ6mcsz:HU5rCOTeiJWAhxMvU8Ifx3DG9EhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3044 38BC.tmp 2120 3949.tmp 2688 3A81.tmp 2576 3B4C.tmp 2668 3BB9.tmp 2716 3CB2.tmp 2440 3DEA.tmp 2464 3E96.tmp 2436 3F61.tmp 3020 401C.tmp 3052 40B8.tmp 2728 41A2.tmp 2892 427C.tmp 3048 4338.tmp 2800 4402.tmp 2768 44EC.tmp 1644 45B7.tmp 2736 4672.tmp 2796 475C.tmp 1892 4837.tmp 524 4911.tmp 776 4A1A.tmp 1196 4B91.tmp 1524 4C3C.tmp 848 4CAA.tmp 2128 4D17.tmp 1228 4D94.tmp 1480 4E20.tmp 300 4E8D.tmp 2964 4F1A.tmp 2064 4FA6.tmp 2256 5023.tmp 2136 50A0.tmp 584 512C.tmp 2072 518A.tmp 640 51F7.tmp 436 5274.tmp 2372 52F0.tmp 2312 536D.tmp 1036 53EA.tmp 1540 5457.tmp 948 54C4.tmp 928 5541.tmp 2140 55CE.tmp 1672 564A.tmp 460 56B8.tmp 364 5734.tmp 2988 57D0.tmp 2124 584D.tmp 2240 58DA.tmp 1956 5966.tmp 1504 59E3.tmp 1588 5A6F.tmp 3060 5ADC.tmp 1604 5B4A.tmp 888 5BB7.tmp 2724 5C34.tmp 3044 5CA1.tmp 2704 5D1E.tmp 2712 5DD9.tmp 2112 5E65.tmp 2424 5EE2.tmp 2552 5F4F.tmp 2952 60D5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2724 2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe 3044 38BC.tmp 2120 3949.tmp 2688 3A81.tmp 2576 3B4C.tmp 2668 3BB9.tmp 2716 3CB2.tmp 2440 3DEA.tmp 2464 3E96.tmp 2436 3F61.tmp 3020 401C.tmp 3052 40B8.tmp 2728 41A2.tmp 2892 427C.tmp 3048 4338.tmp 2800 4402.tmp 2768 44EC.tmp 1644 45B7.tmp 2736 4672.tmp 2796 475C.tmp 1892 4837.tmp 524 4911.tmp 776 4A1A.tmp 1196 4B91.tmp 1524 4C3C.tmp 848 4CAA.tmp 2128 4D17.tmp 1228 4D94.tmp 1480 4E20.tmp 300 4E8D.tmp 2964 4F1A.tmp 2064 4FA6.tmp 2256 5023.tmp 2136 50A0.tmp 584 512C.tmp 2072 518A.tmp 640 51F7.tmp 436 5274.tmp 2372 52F0.tmp 2312 536D.tmp 1036 53EA.tmp 1540 5457.tmp 948 54C4.tmp 928 5541.tmp 2140 55CE.tmp 1672 564A.tmp 460 56B8.tmp 364 5734.tmp 2988 57D0.tmp 2124 584D.tmp 2240 58DA.tmp 1956 5966.tmp 1504 59E3.tmp 1588 5A6F.tmp 3060 5ADC.tmp 1604 5B4A.tmp 888 5BB7.tmp 2724 5C34.tmp 3044 5CA1.tmp 2704 5D1E.tmp 2712 5DD9.tmp 2112 5E65.tmp 2424 5EE2.tmp 2552 5F4F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3044 2724 2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe 28 PID 2724 wrote to memory of 3044 2724 2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe 28 PID 2724 wrote to memory of 3044 2724 2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe 28 PID 2724 wrote to memory of 3044 2724 2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe 28 PID 3044 wrote to memory of 2120 3044 38BC.tmp 29 PID 3044 wrote to memory of 2120 3044 38BC.tmp 29 PID 3044 wrote to memory of 2120 3044 38BC.tmp 29 PID 3044 wrote to memory of 2120 3044 38BC.tmp 29 PID 2120 wrote to memory of 2688 2120 3949.tmp 30 PID 2120 wrote to memory of 2688 2120 3949.tmp 30 PID 2120 wrote to memory of 2688 2120 3949.tmp 30 PID 2120 wrote to memory of 2688 2120 3949.tmp 30 PID 2688 wrote to memory of 2576 2688 3A81.tmp 31 PID 2688 wrote to memory of 2576 2688 3A81.tmp 31 PID 2688 wrote to memory of 2576 2688 3A81.tmp 31 PID 2688 wrote to memory of 2576 2688 3A81.tmp 31 PID 2576 wrote to memory of 2668 2576 3B4C.tmp 32 PID 2576 wrote to memory of 2668 2576 3B4C.tmp 32 PID 2576 wrote to memory of 2668 2576 3B4C.tmp 32 PID 2576 wrote to memory of 2668 2576 3B4C.tmp 32 PID 2668 wrote to memory of 2716 2668 3BB9.tmp 33 PID 2668 wrote to memory of 2716 2668 3BB9.tmp 33 PID 2668 wrote to memory of 2716 2668 3BB9.tmp 33 PID 2668 wrote to memory of 2716 2668 3BB9.tmp 33 PID 2716 wrote to memory of 2440 2716 3CB2.tmp 34 PID 2716 wrote to memory of 2440 2716 3CB2.tmp 34 PID 2716 wrote to memory of 2440 2716 3CB2.tmp 34 PID 2716 wrote to memory of 2440 2716 3CB2.tmp 34 PID 2440 wrote to memory of 2464 2440 3DEA.tmp 35 PID 2440 wrote to memory of 2464 2440 3DEA.tmp 35 PID 2440 wrote to memory of 2464 2440 3DEA.tmp 35 PID 2440 wrote to memory of 2464 2440 3DEA.tmp 35 PID 2464 wrote to memory of 2436 2464 3E96.tmp 36 PID 2464 wrote to memory of 2436 2464 3E96.tmp 36 PID 2464 wrote to memory of 2436 2464 3E96.tmp 36 PID 2464 wrote to memory of 2436 2464 3E96.tmp 36 PID 2436 wrote to memory of 3020 2436 3F61.tmp 37 PID 2436 wrote to memory of 3020 2436 3F61.tmp 37 PID 2436 wrote to memory of 3020 2436 3F61.tmp 37 PID 2436 wrote to memory of 3020 2436 3F61.tmp 37 PID 3020 wrote to memory of 3052 3020 401C.tmp 38 PID 3020 wrote to memory of 3052 3020 401C.tmp 38 PID 3020 wrote to memory of 3052 3020 401C.tmp 38 PID 3020 wrote to memory of 3052 3020 401C.tmp 38 PID 3052 wrote to memory of 2728 3052 40B8.tmp 39 PID 3052 wrote to memory of 2728 3052 40B8.tmp 39 PID 3052 wrote to memory of 2728 3052 40B8.tmp 39 PID 3052 wrote to memory of 2728 3052 40B8.tmp 39 PID 2728 wrote to memory of 2892 2728 41A2.tmp 40 PID 2728 wrote to memory of 2892 2728 41A2.tmp 40 PID 2728 wrote to memory of 2892 2728 41A2.tmp 40 PID 2728 wrote to memory of 2892 2728 41A2.tmp 40 PID 2892 wrote to memory of 3048 2892 427C.tmp 41 PID 2892 wrote to memory of 3048 2892 427C.tmp 41 PID 2892 wrote to memory of 3048 2892 427C.tmp 41 PID 2892 wrote to memory of 3048 2892 427C.tmp 41 PID 3048 wrote to memory of 2800 3048 4338.tmp 42 PID 3048 wrote to memory of 2800 3048 4338.tmp 42 PID 3048 wrote to memory of 2800 3048 4338.tmp 42 PID 3048 wrote to memory of 2800 3048 4338.tmp 42 PID 2800 wrote to memory of 2768 2800 4402.tmp 43 PID 2800 wrote to memory of 2768 2800 4402.tmp 43 PID 2800 wrote to memory of 2768 2800 4402.tmp 43 PID 2800 wrote to memory of 2768 2800 4402.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_37f7c693ee3c9a698de76bcaa7175016_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\55CE.tmp"C:\Users\Admin\AppData\Local\Temp\55CE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:460 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364 -
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"C:\Users\Admin\AppData\Local\Temp\5DD9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"65⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\622C.tmp"C:\Users\Admin\AppData\Local\Temp\622C.tmp"67⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\628A.tmp"C:\Users\Admin\AppData\Local\Temp\628A.tmp"68⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"70⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"71⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"72⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"73⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"74⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"75⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"76⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"77⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"78⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"79⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"80⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"81⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"82⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"83⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"84⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"85⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"86⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"87⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"88⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"89⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"90⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"91⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"92⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"94⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"95⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"96⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"97⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"98⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"99⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"100⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"102⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"103⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"104⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"105⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"106⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"107⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"108⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"109⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"110⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"111⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"112⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"113⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"114⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"116⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"117⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"118⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"119⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"120⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"121⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"122⤵PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-