Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22/04/2024, 21:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe
-
Size
486KB
-
MD5
4a2ba5a28ed61c086461ba8cf6f65fa8
-
SHA1
cbd587650a68d6fb991b4466979da907fbfa1c18
-
SHA256
bb5a26ad69413bc09c83fe533b42d0a02c2d48c077e7d802a7c44722d6adf175
-
SHA512
bef994cf2cf0ad36751757727e33254fd3277fe2f7234e872d4ce0b5b226236533fa2a3f1d3eeae91ed72e10ade6fb3c1198140cce26769b9269f4ad9036c212
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7himHD5dyoja9lIOUsUb7WcAnrJqb2FDbxTLa:UU5rCOTeiDsOHyt6Oe7Rb2F5sNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1656 86A.tmp 2512 8D7.tmp 2564 944.tmp 2636 9B1.tmp 2688 A0F.tmp 2428 A6C.tmp 2456 ADA.tmp 2592 B37.tmp 2424 BA4.tmp 2484 C02.tmp 2472 C60.tmp 1504 CDC.tmp 2140 D3A.tmp 1124 DA7.tmp 2648 E24.tmp 548 E82.tmp 292 ED0.tmp 1584 F2D.tmp 2148 F9A.tmp 2728 1008.tmp 844 1075.tmp 848 10E2.tmp 2520 1130.tmp 2980 116E.tmp 2596 11BC.tmp 2060 11FB.tmp 2460 1239.tmp 1664 1278.tmp 1876 12C6.tmp 336 1304.tmp 988 1342.tmp 2808 1381.tmp 1056 13CF.tmp 544 140D.tmp 2384 144C.tmp 2024 148A.tmp 2284 14C8.tmp 2388 1516.tmp 2244 1555.tmp 1648 1593.tmp 2192 15D2.tmp 352 1610.tmp 1048 164E.tmp 820 169C.tmp 760 16EA.tmp 908 1729.tmp 272 1777.tmp 3056 17D4.tmp 1900 1813.tmp 2320 1851.tmp 3036 189F.tmp 572 18DE.tmp 2776 192C.tmp 1436 196A.tmp 2920 19B8.tmp 1936 19F6.tmp 1532 1A44.tmp 2240 1A92.tmp 3044 1AE0.tmp 2528 1B1F.tmp 2204 1B6D.tmp 2672 1BBB.tmp 2572 1BF9.tmp 2548 1C38.tmp -
Loads dropped DLL 64 IoCs
pid Process 3068 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 1656 86A.tmp 2512 8D7.tmp 2564 944.tmp 2636 9B1.tmp 2688 A0F.tmp 2428 A6C.tmp 2456 ADA.tmp 2592 B37.tmp 2424 BA4.tmp 2484 C02.tmp 2472 C60.tmp 1504 CDC.tmp 2140 D3A.tmp 1124 DA7.tmp 2648 E24.tmp 548 E82.tmp 292 ED0.tmp 1584 F2D.tmp 2148 F9A.tmp 2728 1008.tmp 844 1075.tmp 848 10E2.tmp 2520 1130.tmp 2980 116E.tmp 2596 11BC.tmp 2060 11FB.tmp 2460 1239.tmp 1664 1278.tmp 1876 12C6.tmp 336 1304.tmp 988 1342.tmp 2808 1381.tmp 1056 13CF.tmp 544 140D.tmp 2384 144C.tmp 2024 148A.tmp 2284 14C8.tmp 2388 1516.tmp 2244 1555.tmp 1648 1593.tmp 2192 15D2.tmp 352 1610.tmp 1048 164E.tmp 820 169C.tmp 760 16EA.tmp 908 1729.tmp 272 1777.tmp 3056 17D4.tmp 1900 1813.tmp 2320 1851.tmp 3036 189F.tmp 572 18DE.tmp 2776 192C.tmp 1436 196A.tmp 2920 19B8.tmp 1936 19F6.tmp 1532 1A44.tmp 2240 1A92.tmp 3044 1AE0.tmp 2528 1B1F.tmp 2204 1B6D.tmp 2672 1BBB.tmp 2572 1BF9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1656 3068 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 28 PID 3068 wrote to memory of 1656 3068 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 28 PID 3068 wrote to memory of 1656 3068 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 28 PID 3068 wrote to memory of 1656 3068 2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe 28 PID 1656 wrote to memory of 2512 1656 86A.tmp 29 PID 1656 wrote to memory of 2512 1656 86A.tmp 29 PID 1656 wrote to memory of 2512 1656 86A.tmp 29 PID 1656 wrote to memory of 2512 1656 86A.tmp 29 PID 2512 wrote to memory of 2564 2512 8D7.tmp 30 PID 2512 wrote to memory of 2564 2512 8D7.tmp 30 PID 2512 wrote to memory of 2564 2512 8D7.tmp 30 PID 2512 wrote to memory of 2564 2512 8D7.tmp 30 PID 2564 wrote to memory of 2636 2564 944.tmp 31 PID 2564 wrote to memory of 2636 2564 944.tmp 31 PID 2564 wrote to memory of 2636 2564 944.tmp 31 PID 2564 wrote to memory of 2636 2564 944.tmp 31 PID 2636 wrote to memory of 2688 2636 9B1.tmp 32 PID 2636 wrote to memory of 2688 2636 9B1.tmp 32 PID 2636 wrote to memory of 2688 2636 9B1.tmp 32 PID 2636 wrote to memory of 2688 2636 9B1.tmp 32 PID 2688 wrote to memory of 2428 2688 A0F.tmp 33 PID 2688 wrote to memory of 2428 2688 A0F.tmp 33 PID 2688 wrote to memory of 2428 2688 A0F.tmp 33 PID 2688 wrote to memory of 2428 2688 A0F.tmp 33 PID 2428 wrote to memory of 2456 2428 A6C.tmp 34 PID 2428 wrote to memory of 2456 2428 A6C.tmp 34 PID 2428 wrote to memory of 2456 2428 A6C.tmp 34 PID 2428 wrote to memory of 2456 2428 A6C.tmp 34 PID 2456 wrote to memory of 2592 2456 ADA.tmp 35 PID 2456 wrote to memory of 2592 2456 ADA.tmp 35 PID 2456 wrote to memory of 2592 2456 ADA.tmp 35 PID 2456 wrote to memory of 2592 2456 ADA.tmp 35 PID 2592 wrote to memory of 2424 2592 B37.tmp 36 PID 2592 wrote to memory of 2424 2592 B37.tmp 36 PID 2592 wrote to memory of 2424 2592 B37.tmp 36 PID 2592 wrote to memory of 2424 2592 B37.tmp 36 PID 2424 wrote to memory of 2484 2424 BA4.tmp 37 PID 2424 wrote to memory of 2484 2424 BA4.tmp 37 PID 2424 wrote to memory of 2484 2424 BA4.tmp 37 PID 2424 wrote to memory of 2484 2424 BA4.tmp 37 PID 2484 wrote to memory of 2472 2484 C02.tmp 38 PID 2484 wrote to memory of 2472 2484 C02.tmp 38 PID 2484 wrote to memory of 2472 2484 C02.tmp 38 PID 2484 wrote to memory of 2472 2484 C02.tmp 38 PID 2472 wrote to memory of 1504 2472 C60.tmp 39 PID 2472 wrote to memory of 1504 2472 C60.tmp 39 PID 2472 wrote to memory of 1504 2472 C60.tmp 39 PID 2472 wrote to memory of 1504 2472 C60.tmp 39 PID 1504 wrote to memory of 2140 1504 CDC.tmp 40 PID 1504 wrote to memory of 2140 1504 CDC.tmp 40 PID 1504 wrote to memory of 2140 1504 CDC.tmp 40 PID 1504 wrote to memory of 2140 1504 CDC.tmp 40 PID 2140 wrote to memory of 1124 2140 D3A.tmp 41 PID 2140 wrote to memory of 1124 2140 D3A.tmp 41 PID 2140 wrote to memory of 1124 2140 D3A.tmp 41 PID 2140 wrote to memory of 1124 2140 D3A.tmp 41 PID 1124 wrote to memory of 2648 1124 DA7.tmp 42 PID 1124 wrote to memory of 2648 1124 DA7.tmp 42 PID 1124 wrote to memory of 2648 1124 DA7.tmp 42 PID 1124 wrote to memory of 2648 1124 DA7.tmp 42 PID 2648 wrote to memory of 548 2648 E24.tmp 43 PID 2648 wrote to memory of 548 2648 E24.tmp 43 PID 2648 wrote to memory of 548 2648 E24.tmp 43 PID 2648 wrote to memory of 548 2648 E24.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_4a2ba5a28ed61c086461ba8cf6f65fa8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\86A.tmp"C:\Users\Admin\AppData\Local\Temp\86A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"65⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"67⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"68⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"69⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"70⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"71⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"72⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"73⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"74⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"75⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"76⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"77⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"78⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"79⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"80⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"81⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"82⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"83⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"84⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"85⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"86⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"88⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"89⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"90⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"91⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"92⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"93⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"94⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"95⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"96⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"97⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"98⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"99⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"100⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"101⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"102⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"103⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"104⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"105⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"106⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"107⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"108⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"109⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"110⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"111⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"112⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"113⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"114⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"115⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"116⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"118⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"119⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"120⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"121⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-