Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 04:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe
-
Size
486KB
-
MD5
9569274dfc26436c72e9c8545a9d055e
-
SHA1
0e7cc6cf26fb045ead6a8d56e1655bc4af7e653b
-
SHA256
475746de728d56e0b9cc8c4bc222dacd922b02039ba7bc60cfcc4a752e142bea
-
SHA512
db3ccbe0c9795c4fb3033d371c895a65ec725fa26a8ba5ae7a4f5946faec5867e15c8c24f6d2b472fce089490b7edb80ba64c92151d5e75050fd9a4a9a386c85
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7VyuRJQ641hRyV9X+4TNdqTZZi2BVY2Vfu2a:UU5rCOTeiDfRY1T+O4C62Q2tu21NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2096 D88.tmp 2500 E14.tmp 2552 E91.tmp 2696 EEF.tmp 2532 F5C.tmp 2692 FBA.tmp 2508 1027.tmp 2520 1084.tmp 2420 1101.tmp 2528 116E.tmp 2580 11CC.tmp 848 122A.tmp 2744 1287.tmp 2812 12E5.tmp 356 1342.tmp 1208 13B0.tmp 1276 140D.tmp 1432 146B.tmp 2392 14C8.tmp 2640 1516.tmp 2944 1564.tmp 1240 15C2.tmp 1684 1620.tmp 1956 166E.tmp 2968 16AC.tmp 2228 16EA.tmp 2780 1738.tmp 1724 1777.tmp 1940 17B5.tmp 764 17F4.tmp 576 1842.tmp 1568 1880.tmp 1800 18BE.tmp 1704 18FD.tmp 2368 194B.tmp 916 1999.tmp 2892 19D7.tmp 1108 1A25.tmp 1948 1A73.tmp 2788 1AB2.tmp 1232 1B00.tmp 948 1B3E.tmp 992 1B8C.tmp 2316 1BCA.tmp 788 1C09.tmp 2884 1C57.tmp 1620 1C95.tmp 1664 1CD4.tmp 1452 1D12.tmp 2276 1D50.tmp 2164 1D9E.tmp 1312 1DDD.tmp 2324 1E2B.tmp 1884 1E79.tmp 2100 1EB7.tmp 3048 1EF6.tmp 2012 1F44.tmp 2592 1F92.tmp 2240 1FD0.tmp 2612 200E.tmp 2616 204D.tmp 2560 20BA.tmp 2556 20F8.tmp 2532 2146.tmp -
Loads dropped DLL 64 IoCs
pid Process 2012 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 2096 D88.tmp 2500 E14.tmp 2552 E91.tmp 2696 EEF.tmp 2532 F5C.tmp 2692 FBA.tmp 2508 1027.tmp 2520 1084.tmp 2420 1101.tmp 2528 116E.tmp 2580 11CC.tmp 848 122A.tmp 2744 1287.tmp 2812 12E5.tmp 356 1342.tmp 1208 13B0.tmp 1276 140D.tmp 1432 146B.tmp 2392 14C8.tmp 2640 1516.tmp 2944 1564.tmp 1240 15C2.tmp 1684 1620.tmp 1956 166E.tmp 2968 16AC.tmp 2228 16EA.tmp 2780 1738.tmp 1724 1777.tmp 1940 17B5.tmp 764 17F4.tmp 576 1842.tmp 1568 1880.tmp 1800 18BE.tmp 1704 18FD.tmp 2368 194B.tmp 916 1999.tmp 2892 19D7.tmp 1108 1A25.tmp 1948 1A73.tmp 2788 1AB2.tmp 1232 1B00.tmp 948 1B3E.tmp 992 1B8C.tmp 2316 1BCA.tmp 788 1C09.tmp 2884 1C57.tmp 1620 1C95.tmp 1664 1CD4.tmp 1452 1D12.tmp 2276 1D50.tmp 2164 1D9E.tmp 1312 1DDD.tmp 2324 1E2B.tmp 1884 1E79.tmp 2100 1EB7.tmp 3048 1EF6.tmp 2012 1F44.tmp 2592 1F92.tmp 2240 1FD0.tmp 2612 200E.tmp 2616 204D.tmp 2560 20BA.tmp 2556 20F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2096 2012 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 28 PID 2012 wrote to memory of 2096 2012 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 28 PID 2012 wrote to memory of 2096 2012 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 28 PID 2012 wrote to memory of 2096 2012 2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe 28 PID 2096 wrote to memory of 2500 2096 D88.tmp 29 PID 2096 wrote to memory of 2500 2096 D88.tmp 29 PID 2096 wrote to memory of 2500 2096 D88.tmp 29 PID 2096 wrote to memory of 2500 2096 D88.tmp 29 PID 2500 wrote to memory of 2552 2500 E14.tmp 30 PID 2500 wrote to memory of 2552 2500 E14.tmp 30 PID 2500 wrote to memory of 2552 2500 E14.tmp 30 PID 2500 wrote to memory of 2552 2500 E14.tmp 30 PID 2552 wrote to memory of 2696 2552 E91.tmp 31 PID 2552 wrote to memory of 2696 2552 E91.tmp 31 PID 2552 wrote to memory of 2696 2552 E91.tmp 31 PID 2552 wrote to memory of 2696 2552 E91.tmp 31 PID 2696 wrote to memory of 2532 2696 EEF.tmp 32 PID 2696 wrote to memory of 2532 2696 EEF.tmp 32 PID 2696 wrote to memory of 2532 2696 EEF.tmp 32 PID 2696 wrote to memory of 2532 2696 EEF.tmp 32 PID 2532 wrote to memory of 2692 2532 F5C.tmp 33 PID 2532 wrote to memory of 2692 2532 F5C.tmp 33 PID 2532 wrote to memory of 2692 2532 F5C.tmp 33 PID 2532 wrote to memory of 2692 2532 F5C.tmp 33 PID 2692 wrote to memory of 2508 2692 FBA.tmp 34 PID 2692 wrote to memory of 2508 2692 FBA.tmp 34 PID 2692 wrote to memory of 2508 2692 FBA.tmp 34 PID 2692 wrote to memory of 2508 2692 FBA.tmp 34 PID 2508 wrote to memory of 2520 2508 1027.tmp 35 PID 2508 wrote to memory of 2520 2508 1027.tmp 35 PID 2508 wrote to memory of 2520 2508 1027.tmp 35 PID 2508 wrote to memory of 2520 2508 1027.tmp 35 PID 2520 wrote to memory of 2420 2520 1084.tmp 36 PID 2520 wrote to memory of 2420 2520 1084.tmp 36 PID 2520 wrote to memory of 2420 2520 1084.tmp 36 PID 2520 wrote to memory of 2420 2520 1084.tmp 36 PID 2420 wrote to memory of 2528 2420 1101.tmp 37 PID 2420 wrote to memory of 2528 2420 1101.tmp 37 PID 2420 wrote to memory of 2528 2420 1101.tmp 37 PID 2420 wrote to memory of 2528 2420 1101.tmp 37 PID 2528 wrote to memory of 2580 2528 116E.tmp 38 PID 2528 wrote to memory of 2580 2528 116E.tmp 38 PID 2528 wrote to memory of 2580 2528 116E.tmp 38 PID 2528 wrote to memory of 2580 2528 116E.tmp 38 PID 2580 wrote to memory of 848 2580 11CC.tmp 39 PID 2580 wrote to memory of 848 2580 11CC.tmp 39 PID 2580 wrote to memory of 848 2580 11CC.tmp 39 PID 2580 wrote to memory of 848 2580 11CC.tmp 39 PID 848 wrote to memory of 2744 848 122A.tmp 40 PID 848 wrote to memory of 2744 848 122A.tmp 40 PID 848 wrote to memory of 2744 848 122A.tmp 40 PID 848 wrote to memory of 2744 848 122A.tmp 40 PID 2744 wrote to memory of 2812 2744 1287.tmp 41 PID 2744 wrote to memory of 2812 2744 1287.tmp 41 PID 2744 wrote to memory of 2812 2744 1287.tmp 41 PID 2744 wrote to memory of 2812 2744 1287.tmp 41 PID 2812 wrote to memory of 356 2812 12E5.tmp 42 PID 2812 wrote to memory of 356 2812 12E5.tmp 42 PID 2812 wrote to memory of 356 2812 12E5.tmp 42 PID 2812 wrote to memory of 356 2812 12E5.tmp 42 PID 356 wrote to memory of 1208 356 1342.tmp 43 PID 356 wrote to memory of 1208 356 1342.tmp 43 PID 356 wrote to memory of 1208 356 1342.tmp 43 PID 356 wrote to memory of 1208 356 1342.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_9569274dfc26436c72e9c8545a9d055e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"65⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"67⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"68⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"69⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"72⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"73⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"74⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"75⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"76⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"77⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"78⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"79⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"80⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"81⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"82⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"83⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"84⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"85⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"86⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"87⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"88⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"89⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"91⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"92⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"93⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"94⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"95⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"96⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"97⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"98⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"99⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"100⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"101⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"102⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"103⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"104⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"105⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"106⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"107⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"108⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"109⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"110⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"111⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"112⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"113⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"114⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"115⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"116⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"117⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"118⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"119⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"120⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"121⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"122⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-