Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe
-
Size
765KB
-
MD5
7e0b7a807157c9f2967d01e3549ab4e0
-
SHA1
988d7b2ee2a216ea4017384d8f0ffebef7e4dad5
-
SHA256
c8fd1632447a36527b3833c17e21ef9021a94032161c60628a49beacf238766f
-
SHA512
b9b28ea414ce5b04c48b3f814a0646b68930c8a339701e355d58b9b2c693931ff501d88516495e4113b45848090112f52af498a2a8f0aed9371f167a29c05f02
-
SSDEEP
12288:ZU5rCOTeiD5/Se+XltM9Acvz39UY1b3ZF5rn5rLOa54U5w5A:ZUQOJDR7aUAcvRr3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2052 426.tmp 2000 4A2.tmp 2344 53E.tmp 1712 5AC.tmp 2748 648.tmp 2816 6C4.tmp 2636 751.tmp 2860 7ED.tmp 1676 879.tmp 2536 915.tmp 3028 9A2.tmp 2024 A1E.tmp 2852 AAB.tmp 2900 B37.tmp 2912 BA4.tmp 1512 C12.tmp 2336 C50.tmp 1620 D1B.tmp 744 DA7.tmp 1452 E14.tmp 2768 EB0.tmp 3064 F1E.tmp 1412 F8B.tmp 2560 FC9.tmp 2012 1008.tmp 2240 1046.tmp 1728 1084.tmp 2712 10C3.tmp 2504 1101.tmp 2080 1140.tmp 596 117E.tmp 1032 11BC.tmp 588 11FB.tmp 1644 1239.tmp 1788 1278.tmp 1080 12B6.tmp 1652 12F4.tmp 408 1333.tmp 1140 1371.tmp 2292 13B0.tmp 2496 13EE.tmp 1556 142C.tmp 948 146B.tmp 1892 14A9.tmp 1248 14E8.tmp 1812 1526.tmp 684 1564.tmp 2088 15B2.tmp 2076 15F1.tmp 2456 162F.tmp 2056 166E.tmp 556 16AC.tmp 340 170A.tmp 2208 1758.tmp 1656 1796.tmp 2364 17D4.tmp 1604 1813.tmp 2824 1851.tmp 2700 1890.tmp 2660 18CE.tmp 2476 190C.tmp 2732 194B.tmp 2672 1989.tmp 2676 19C8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2364 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 2052 426.tmp 2000 4A2.tmp 2344 53E.tmp 1712 5AC.tmp 2748 648.tmp 2816 6C4.tmp 2636 751.tmp 2860 7ED.tmp 1676 879.tmp 2536 915.tmp 3028 9A2.tmp 2024 A1E.tmp 2852 AAB.tmp 2900 B37.tmp 2912 BA4.tmp 1512 C12.tmp 2336 C50.tmp 1620 D1B.tmp 744 DA7.tmp 1452 E14.tmp 2768 EB0.tmp 3064 F1E.tmp 1412 F8B.tmp 2560 FC9.tmp 2012 1008.tmp 2240 1046.tmp 1728 1084.tmp 2712 10C3.tmp 2504 1101.tmp 2080 1140.tmp 596 117E.tmp 1032 11BC.tmp 588 11FB.tmp 1644 1239.tmp 1788 1278.tmp 1080 12B6.tmp 1652 12F4.tmp 408 1333.tmp 1140 1371.tmp 2292 13B0.tmp 2496 13EE.tmp 1556 142C.tmp 948 146B.tmp 1892 14A9.tmp 1248 14E8.tmp 1812 1526.tmp 684 1564.tmp 2088 15B2.tmp 2076 15F1.tmp 2456 162F.tmp 2056 166E.tmp 556 16AC.tmp 340 170A.tmp 2208 1758.tmp 1656 1796.tmp 2364 17D4.tmp 1604 1813.tmp 2824 1851.tmp 2700 1890.tmp 2660 18CE.tmp 2476 190C.tmp 2732 194B.tmp 2672 1989.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2052 2364 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 28 PID 2364 wrote to memory of 2052 2364 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 28 PID 2364 wrote to memory of 2052 2364 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 28 PID 2364 wrote to memory of 2052 2364 2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe 28 PID 2052 wrote to memory of 2000 2052 426.tmp 29 PID 2052 wrote to memory of 2000 2052 426.tmp 29 PID 2052 wrote to memory of 2000 2052 426.tmp 29 PID 2052 wrote to memory of 2000 2052 426.tmp 29 PID 2000 wrote to memory of 2344 2000 4A2.tmp 30 PID 2000 wrote to memory of 2344 2000 4A2.tmp 30 PID 2000 wrote to memory of 2344 2000 4A2.tmp 30 PID 2000 wrote to memory of 2344 2000 4A2.tmp 30 PID 2344 wrote to memory of 1712 2344 53E.tmp 31 PID 2344 wrote to memory of 1712 2344 53E.tmp 31 PID 2344 wrote to memory of 1712 2344 53E.tmp 31 PID 2344 wrote to memory of 1712 2344 53E.tmp 31 PID 1712 wrote to memory of 2748 1712 5AC.tmp 32 PID 1712 wrote to memory of 2748 1712 5AC.tmp 32 PID 1712 wrote to memory of 2748 1712 5AC.tmp 32 PID 1712 wrote to memory of 2748 1712 5AC.tmp 32 PID 2748 wrote to memory of 2816 2748 648.tmp 33 PID 2748 wrote to memory of 2816 2748 648.tmp 33 PID 2748 wrote to memory of 2816 2748 648.tmp 33 PID 2748 wrote to memory of 2816 2748 648.tmp 33 PID 2816 wrote to memory of 2636 2816 6C4.tmp 34 PID 2816 wrote to memory of 2636 2816 6C4.tmp 34 PID 2816 wrote to memory of 2636 2816 6C4.tmp 34 PID 2816 wrote to memory of 2636 2816 6C4.tmp 34 PID 2636 wrote to memory of 2860 2636 751.tmp 35 PID 2636 wrote to memory of 2860 2636 751.tmp 35 PID 2636 wrote to memory of 2860 2636 751.tmp 35 PID 2636 wrote to memory of 2860 2636 751.tmp 35 PID 2860 wrote to memory of 1676 2860 7ED.tmp 36 PID 2860 wrote to memory of 1676 2860 7ED.tmp 36 PID 2860 wrote to memory of 1676 2860 7ED.tmp 36 PID 2860 wrote to memory of 1676 2860 7ED.tmp 36 PID 1676 wrote to memory of 2536 1676 879.tmp 37 PID 1676 wrote to memory of 2536 1676 879.tmp 37 PID 1676 wrote to memory of 2536 1676 879.tmp 37 PID 1676 wrote to memory of 2536 1676 879.tmp 37 PID 2536 wrote to memory of 3028 2536 915.tmp 38 PID 2536 wrote to memory of 3028 2536 915.tmp 38 PID 2536 wrote to memory of 3028 2536 915.tmp 38 PID 2536 wrote to memory of 3028 2536 915.tmp 38 PID 3028 wrote to memory of 2024 3028 9A2.tmp 39 PID 3028 wrote to memory of 2024 3028 9A2.tmp 39 PID 3028 wrote to memory of 2024 3028 9A2.tmp 39 PID 3028 wrote to memory of 2024 3028 9A2.tmp 39 PID 2024 wrote to memory of 2852 2024 A1E.tmp 40 PID 2024 wrote to memory of 2852 2024 A1E.tmp 40 PID 2024 wrote to memory of 2852 2024 A1E.tmp 40 PID 2024 wrote to memory of 2852 2024 A1E.tmp 40 PID 2852 wrote to memory of 2900 2852 AAB.tmp 41 PID 2852 wrote to memory of 2900 2852 AAB.tmp 41 PID 2852 wrote to memory of 2900 2852 AAB.tmp 41 PID 2852 wrote to memory of 2900 2852 AAB.tmp 41 PID 2900 wrote to memory of 2912 2900 B37.tmp 42 PID 2900 wrote to memory of 2912 2900 B37.tmp 42 PID 2900 wrote to memory of 2912 2900 B37.tmp 42 PID 2900 wrote to memory of 2912 2900 B37.tmp 42 PID 2912 wrote to memory of 1512 2912 BA4.tmp 43 PID 2912 wrote to memory of 1512 2912 BA4.tmp 43 PID 2912 wrote to memory of 1512 2912 BA4.tmp 43 PID 2912 wrote to memory of 1512 2912 BA4.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_7e0b7a807157c9f2967d01e3549ab4e0_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"65⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"69⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"71⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"72⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"73⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"74⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"75⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"76⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"79⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"80⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"81⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"82⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"83⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"84⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"85⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"86⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"87⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"88⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"89⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"90⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"91⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"93⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"94⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"95⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"96⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"97⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"98⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"99⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"100⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"101⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"102⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"103⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"104⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"105⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"106⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"107⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"108⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"109⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"110⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"112⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"113⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"114⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"115⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"116⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"117⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"118⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"119⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"120⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"121⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-