Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 11:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe
-
Size
486KB
-
MD5
1ab9830ee4afbca97925a538f647c52b
-
SHA1
b8097e5c2103e531e0e9861ae1385516de5a6dd4
-
SHA256
09b239f0e8842b21b2efa8bf854bdea808bdd36d55c5e1e90beece01634e0759
-
SHA512
a618e87a4b02686aab8f95904a905d121eb172de700f21ff9b62a96a8589f71d49e8fd4b50932f189e437f0d5c34c3cecf726ead887e069b64cbe9bc045d3bbe
-
SSDEEP
12288:/U5rCOTeiDsf1VyX8ixJGwdMbg93YzsGljQDNZ:/UQOJDsfopJGrbg9384N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2764 1F82.tmp 2976 1FD0.tmp 2640 203D.tmp 2632 20AA.tmp 2616 2108.tmp 2552 2166.tmp 2604 21D3.tmp 2520 2230.tmp 2472 229E.tmp 2956 22FB.tmp 1516 2368.tmp 2708 23C6.tmp 2740 2433.tmp 2848 2491.tmp 2900 24EE.tmp 1592 255C.tmp 1800 25B9.tmp 1372 2617.tmp 2288 2684.tmp 1680 26F1.tmp 708 273F.tmp 1228 27BC.tmp 3024 281A.tmp 2504 2858.tmp 2912 2896.tmp 324 28E4.tmp 1852 2923.tmp 2712 2961.tmp 1744 29A0.tmp 2264 29DE.tmp 576 2A1C.tmp 864 2A6A.tmp 1796 2AA9.tmp 2924 2AF7.tmp 1244 2B45.tmp 1220 2B83.tmp 452 2BC2.tmp 3028 2C00.tmp 2104 2C4E.tmp 1704 2C8C.tmp 1240 2CCB.tmp 1036 2D09.tmp 472 2D57.tmp 320 2D96.tmp 280 2DD4.tmp 928 2E12.tmp 1476 2E51.tmp 1600 2E8F.tmp 1688 2ECE.tmp 2148 2F0C.tmp 1988 2F4A.tmp 1652 2F89.tmp 2000 2FC7.tmp 1720 3015.tmp 2948 3054.tmp 2980 3092.tmp 1536 30D0.tmp 2892 310F.tmp 1936 314D.tmp 2976 318C.tmp 2784 31CA.tmp 2540 3208.tmp 2632 3247.tmp 2532 3285.tmp -
Loads dropped DLL 64 IoCs
pid Process 1968 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 2764 1F82.tmp 2976 1FD0.tmp 2640 203D.tmp 2632 20AA.tmp 2616 2108.tmp 2552 2166.tmp 2604 21D3.tmp 2520 2230.tmp 2472 229E.tmp 2956 22FB.tmp 1516 2368.tmp 2708 23C6.tmp 2740 2433.tmp 2848 2491.tmp 2900 24EE.tmp 1592 255C.tmp 1800 25B9.tmp 1372 2617.tmp 2288 2684.tmp 1680 26F1.tmp 708 273F.tmp 1228 27BC.tmp 3024 281A.tmp 2504 2858.tmp 2912 2896.tmp 324 28E4.tmp 1852 2923.tmp 2712 2961.tmp 1744 29A0.tmp 2264 29DE.tmp 576 2A1C.tmp 864 2A6A.tmp 1796 2AA9.tmp 2924 2AF7.tmp 1244 2B45.tmp 1220 2B83.tmp 452 2BC2.tmp 3028 2C00.tmp 2104 2C4E.tmp 1704 2C8C.tmp 1240 2CCB.tmp 1036 2D09.tmp 472 2D57.tmp 320 2D96.tmp 280 2DD4.tmp 928 2E12.tmp 1476 2E51.tmp 1600 2E8F.tmp 1688 2ECE.tmp 2148 2F0C.tmp 1988 2F4A.tmp 1652 2F89.tmp 2000 2FC7.tmp 1720 3015.tmp 2948 3054.tmp 2980 3092.tmp 1536 30D0.tmp 2892 310F.tmp 1936 314D.tmp 2976 318C.tmp 2784 31CA.tmp 2540 3208.tmp 2632 3247.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2764 1968 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe 28 PID 2764 wrote to memory of 2976 2764 1F82.tmp 29 PID 2764 wrote to memory of 2976 2764 1F82.tmp 29 PID 2764 wrote to memory of 2976 2764 1F82.tmp 29 PID 2764 wrote to memory of 2976 2764 1F82.tmp 29 PID 2976 wrote to memory of 2640 2976 1FD0.tmp 30 PID 2976 wrote to memory of 2640 2976 1FD0.tmp 30 PID 2976 wrote to memory of 2640 2976 1FD0.tmp 30 PID 2976 wrote to memory of 2640 2976 1FD0.tmp 30 PID 2640 wrote to memory of 2632 2640 203D.tmp 31 PID 2640 wrote to memory of 2632 2640 203D.tmp 31 PID 2640 wrote to memory of 2632 2640 203D.tmp 31 PID 2640 wrote to memory of 2632 2640 203D.tmp 31 PID 2632 wrote to memory of 2616 2632 20AA.tmp 32 PID 2632 wrote to memory of 2616 2632 20AA.tmp 32 PID 2632 wrote to memory of 2616 2632 20AA.tmp 32 PID 2632 wrote to memory of 2616 2632 20AA.tmp 32 PID 2616 wrote to memory of 2552 2616 2108.tmp 33 PID 2616 wrote to memory of 2552 2616 2108.tmp 33 PID 2616 wrote to memory of 2552 2616 2108.tmp 33 PID 2616 wrote to memory of 2552 2616 2108.tmp 33 PID 2552 wrote to memory of 2604 2552 2166.tmp 34 PID 2552 wrote to memory of 2604 2552 2166.tmp 34 PID 2552 wrote to memory of 2604 2552 2166.tmp 34 PID 2552 wrote to memory of 2604 2552 2166.tmp 34 PID 2604 wrote to memory of 2520 2604 21D3.tmp 35 PID 2604 wrote to memory of 2520 2604 21D3.tmp 35 PID 2604 wrote to memory of 2520 2604 21D3.tmp 35 PID 2604 wrote to memory of 2520 2604 21D3.tmp 35 PID 2520 wrote to memory of 2472 2520 2230.tmp 36 PID 2520 wrote to memory of 2472 2520 2230.tmp 36 PID 2520 wrote to memory of 2472 2520 2230.tmp 36 PID 2520 wrote to memory of 2472 2520 2230.tmp 36 PID 2472 wrote to memory of 2956 2472 229E.tmp 37 PID 2472 wrote to memory of 2956 2472 229E.tmp 37 PID 2472 wrote to memory of 2956 2472 229E.tmp 37 PID 2472 wrote to memory of 2956 2472 229E.tmp 37 PID 2956 wrote to memory of 1516 2956 22FB.tmp 38 PID 2956 wrote to memory of 1516 2956 22FB.tmp 38 PID 2956 wrote to memory of 1516 2956 22FB.tmp 38 PID 2956 wrote to memory of 1516 2956 22FB.tmp 38 PID 1516 wrote to memory of 2708 1516 2368.tmp 39 PID 1516 wrote to memory of 2708 1516 2368.tmp 39 PID 1516 wrote to memory of 2708 1516 2368.tmp 39 PID 1516 wrote to memory of 2708 1516 2368.tmp 39 PID 2708 wrote to memory of 2740 2708 23C6.tmp 40 PID 2708 wrote to memory of 2740 2708 23C6.tmp 40 PID 2708 wrote to memory of 2740 2708 23C6.tmp 40 PID 2708 wrote to memory of 2740 2708 23C6.tmp 40 PID 2740 wrote to memory of 2848 2740 2433.tmp 41 PID 2740 wrote to memory of 2848 2740 2433.tmp 41 PID 2740 wrote to memory of 2848 2740 2433.tmp 41 PID 2740 wrote to memory of 2848 2740 2433.tmp 41 PID 2848 wrote to memory of 2900 2848 2491.tmp 42 PID 2848 wrote to memory of 2900 2848 2491.tmp 42 PID 2848 wrote to memory of 2900 2848 2491.tmp 42 PID 2848 wrote to memory of 2900 2848 2491.tmp 42 PID 2900 wrote to memory of 1592 2900 24EE.tmp 43 PID 2900 wrote to memory of 1592 2900 24EE.tmp 43 PID 2900 wrote to memory of 1592 2900 24EE.tmp 43 PID 2900 wrote to memory of 1592 2900 24EE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_1ab9830ee4afbca97925a538f647c52b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"65⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"66⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"67⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"68⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"69⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"70⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"72⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"73⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"74⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"75⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"76⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"77⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"79⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"80⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"81⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"82⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"83⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"84⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"85⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"86⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"87⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"88⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"89⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"91⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"92⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"93⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"94⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"95⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"96⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"97⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"98⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"99⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"100⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"101⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"102⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"103⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"104⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"105⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"106⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"107⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"108⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"109⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"110⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"111⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"112⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"113⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"114⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"115⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"116⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"117⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"118⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"119⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"121⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-