Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe
-
Size
486KB
-
MD5
e02951487994ede2461f9b8bb59321ba
-
SHA1
61cfa968eee44d86fe4b61d3b363798fd621755d
-
SHA256
b0f101ae9149decde01b926e290328a7d21ef8fbeebd8947ed36e12da6e190f1
-
SHA512
1cb6a75d856b28bfca0e13bbffc7edf248e975bcce2d15a190b58130a3d3fb4252b17d307ea56b4921574eb278177e69a5a9ab4dcc9033318adddcfc4164ce45
-
SSDEEP
12288:/U5rCOTeiD9fi/3yaVyTtFqrL6575dmwyNZ:/UQOJD9fq3yaITu2rdm5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2312 143C.tmp 2396 149A.tmp 2128 1507.tmp 2244 1555.tmp 2572 1593.tmp 2720 15E1.tmp 2752 162F.tmp 2748 166E.tmp 2468 16AC.tmp 2612 16EA.tmp 2452 1729.tmp 2564 1796.tmp 2988 17D4.tmp 1232 1813.tmp 1532 1851.tmp 2356 189F.tmp 2180 18ED.tmp 1940 192C.tmp 1620 196A.tmp 1492 19A8.tmp 1828 19F6.tmp 1444 1A35.tmp 2480 1A73.tmp 2120 1AC1.tmp 2664 1AF0.tmp 2304 1B2E.tmp 1948 1B6D.tmp 2276 1BBB.tmp 2388 1BEA.tmp 604 1C28.tmp 792 1C66.tmp 1652 1CA5.tmp 2268 1CE3.tmp 1912 1D22.tmp 2412 1D60.tmp 1132 1D8F.tmp 1300 1DBE.tmp 2848 1DEC.tmp 328 1E2B.tmp 1328 1E5A.tmp 1796 1E98.tmp 1788 1ED6.tmp 1228 1F05.tmp 1172 1F44.tmp 1832 1F82.tmp 972 1FC0.tmp 2828 1FFF.tmp 2820 203D.tmp 2964 209B.tmp 2284 20D9.tmp 2424 2146.tmp 1752 21A4.tmp 1216 2221.tmp 2884 225F.tmp 1072 22CC.tmp 2004 231A.tmp 2088 2368.tmp 1632 23A7.tmp 2308 23E5.tmp 1732 2424.tmp 1116 2462.tmp 2696 24A0.tmp 2700 24DF.tmp 2784 251D.tmp -
Loads dropped DLL 64 IoCs
pid Process 1072 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 2312 143C.tmp 2396 149A.tmp 2128 1507.tmp 2244 1555.tmp 2572 1593.tmp 2720 15E1.tmp 2752 162F.tmp 2748 166E.tmp 2468 16AC.tmp 2612 16EA.tmp 2452 1729.tmp 2564 1796.tmp 2988 17D4.tmp 1232 1813.tmp 1532 1851.tmp 2356 189F.tmp 2180 18ED.tmp 1940 192C.tmp 1620 196A.tmp 1492 19A8.tmp 1828 19F6.tmp 1444 1A35.tmp 2480 1A73.tmp 2120 1AC1.tmp 2664 1AF0.tmp 2304 1B2E.tmp 1948 1B6D.tmp 2276 1BBB.tmp 2388 1BEA.tmp 604 1C28.tmp 792 1C66.tmp 1652 1CA5.tmp 2268 1CE3.tmp 1912 1D22.tmp 2412 1D60.tmp 1132 1D8F.tmp 1300 1DBE.tmp 2848 1DEC.tmp 328 1E2B.tmp 1328 1E5A.tmp 1796 1E98.tmp 1788 1ED6.tmp 1228 1F05.tmp 1172 1F44.tmp 1832 1F82.tmp 972 1FC0.tmp 2828 1FFF.tmp 2820 203D.tmp 2964 209B.tmp 2284 20D9.tmp 2424 2146.tmp 1752 21A4.tmp 1216 2221.tmp 2884 225F.tmp 1072 22CC.tmp 2004 231A.tmp 2088 2368.tmp 1632 23A7.tmp 2308 23E5.tmp 1732 2424.tmp 1116 2462.tmp 2696 24A0.tmp 2700 24DF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1072 wrote to memory of 2312 1072 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 28 PID 1072 wrote to memory of 2312 1072 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 28 PID 1072 wrote to memory of 2312 1072 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 28 PID 1072 wrote to memory of 2312 1072 2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe 28 PID 2312 wrote to memory of 2396 2312 143C.tmp 29 PID 2312 wrote to memory of 2396 2312 143C.tmp 29 PID 2312 wrote to memory of 2396 2312 143C.tmp 29 PID 2312 wrote to memory of 2396 2312 143C.tmp 29 PID 2396 wrote to memory of 2128 2396 149A.tmp 30 PID 2396 wrote to memory of 2128 2396 149A.tmp 30 PID 2396 wrote to memory of 2128 2396 149A.tmp 30 PID 2396 wrote to memory of 2128 2396 149A.tmp 30 PID 2128 wrote to memory of 2244 2128 1507.tmp 31 PID 2128 wrote to memory of 2244 2128 1507.tmp 31 PID 2128 wrote to memory of 2244 2128 1507.tmp 31 PID 2128 wrote to memory of 2244 2128 1507.tmp 31 PID 2244 wrote to memory of 2572 2244 1555.tmp 32 PID 2244 wrote to memory of 2572 2244 1555.tmp 32 PID 2244 wrote to memory of 2572 2244 1555.tmp 32 PID 2244 wrote to memory of 2572 2244 1555.tmp 32 PID 2572 wrote to memory of 2720 2572 1593.tmp 33 PID 2572 wrote to memory of 2720 2572 1593.tmp 33 PID 2572 wrote to memory of 2720 2572 1593.tmp 33 PID 2572 wrote to memory of 2720 2572 1593.tmp 33 PID 2720 wrote to memory of 2752 2720 15E1.tmp 34 PID 2720 wrote to memory of 2752 2720 15E1.tmp 34 PID 2720 wrote to memory of 2752 2720 15E1.tmp 34 PID 2720 wrote to memory of 2752 2720 15E1.tmp 34 PID 2752 wrote to memory of 2748 2752 162F.tmp 35 PID 2752 wrote to memory of 2748 2752 162F.tmp 35 PID 2752 wrote to memory of 2748 2752 162F.tmp 35 PID 2752 wrote to memory of 2748 2752 162F.tmp 35 PID 2748 wrote to memory of 2468 2748 166E.tmp 36 PID 2748 wrote to memory of 2468 2748 166E.tmp 36 PID 2748 wrote to memory of 2468 2748 166E.tmp 36 PID 2748 wrote to memory of 2468 2748 166E.tmp 36 PID 2468 wrote to memory of 2612 2468 16AC.tmp 37 PID 2468 wrote to memory of 2612 2468 16AC.tmp 37 PID 2468 wrote to memory of 2612 2468 16AC.tmp 37 PID 2468 wrote to memory of 2612 2468 16AC.tmp 37 PID 2612 wrote to memory of 2452 2612 16EA.tmp 38 PID 2612 wrote to memory of 2452 2612 16EA.tmp 38 PID 2612 wrote to memory of 2452 2612 16EA.tmp 38 PID 2612 wrote to memory of 2452 2612 16EA.tmp 38 PID 2452 wrote to memory of 2564 2452 1729.tmp 39 PID 2452 wrote to memory of 2564 2452 1729.tmp 39 PID 2452 wrote to memory of 2564 2452 1729.tmp 39 PID 2452 wrote to memory of 2564 2452 1729.tmp 39 PID 2564 wrote to memory of 2988 2564 1796.tmp 40 PID 2564 wrote to memory of 2988 2564 1796.tmp 40 PID 2564 wrote to memory of 2988 2564 1796.tmp 40 PID 2564 wrote to memory of 2988 2564 1796.tmp 40 PID 2988 wrote to memory of 1232 2988 17D4.tmp 41 PID 2988 wrote to memory of 1232 2988 17D4.tmp 41 PID 2988 wrote to memory of 1232 2988 17D4.tmp 41 PID 2988 wrote to memory of 1232 2988 17D4.tmp 41 PID 1232 wrote to memory of 1532 1232 1813.tmp 42 PID 1232 wrote to memory of 1532 1232 1813.tmp 42 PID 1232 wrote to memory of 1532 1232 1813.tmp 42 PID 1232 wrote to memory of 1532 1232 1813.tmp 42 PID 1532 wrote to memory of 2356 1532 1851.tmp 43 PID 1532 wrote to memory of 2356 1532 1851.tmp 43 PID 1532 wrote to memory of 2356 1532 1851.tmp 43 PID 1532 wrote to memory of 2356 1532 1851.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e02951487994ede2461f9b8bb59321ba_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"65⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"66⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"67⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"68⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"69⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"70⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"71⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"72⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"73⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"74⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"75⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"76⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"77⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"78⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"79⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"80⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"81⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"82⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"83⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"84⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"85⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"86⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"87⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"88⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"89⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"90⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"91⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"92⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"93⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"94⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"95⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"96⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"97⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"98⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"99⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"100⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"101⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"102⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"103⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"104⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"105⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"106⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"107⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"108⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"109⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"110⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"111⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"112⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"113⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"114⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"115⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"116⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"117⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"118⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"119⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"120⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"121⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-