Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 20:12
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe
-
Size
486KB
-
MD5
d1230f16348cd8180f106270d9cd2526
-
SHA1
5b3c2afde21df77fac0ae119cf0bd147514b4022
-
SHA256
b4489daaae9fae5f9e5f5fd11c0ef0abc36a65c844e5d20a5500c83d6a37eda8
-
SHA512
620e30a9af41fbd1b120466afd4b217e96f276992a94fa1ac7d728b637b96e742b5913252bed71f2ac9d216dddec6070e8d9b9f8e5b22fbed927a00ec7e2d97a
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD79SXDsn+DTbtGd+uDuCCYwDtHs1uRinsH3dZ:UU5rCOTeiDMXA+zu1utcsNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 12A6.tmp 2552 1304.tmp 2624 1371.tmp 2760 13DE.tmp 2756 143C.tmp 2604 149A.tmp 2660 1507.tmp 2584 1584.tmp 2464 15F1.tmp 2880 164E.tmp 2180 16AC.tmp 1564 170A.tmp 1384 1767.tmp 2656 17D4.tmp 2588 1832.tmp 1460 18AF.tmp 1016 190C.tmp 1948 1989.tmp 284 19F6.tmp 2200 1A64.tmp 1264 1AC1.tmp 1284 1B3E.tmp 2132 1B8C.tmp 2240 1BDA.tmp 2016 1C28.tmp 2068 1C66.tmp 2396 1CA5.tmp 1960 1CF3.tmp 588 1D31.tmp 476 1D7F.tmp 1004 1DBE.tmp 1584 1DFC.tmp 1768 1E3A.tmp 1772 1E79.tmp 1724 1EB7.tmp 2248 1F05.tmp 388 1F53.tmp 2376 1FA1.tmp 3060 1FE0.tmp 2092 202E.tmp 2916 207C.tmp 1212 20BA.tmp 1332 20F8.tmp 1248 2146.tmp 2796 2194.tmp 920 21D3.tmp 1964 2211.tmp 2196 225F.tmp 3008 22AD.tmp 2004 22FB.tmp 2792 233A.tmp 2272 2388.tmp 2260 23C6.tmp 880 2404.tmp 2184 2443.tmp 1520 2481.tmp 1672 24CF.tmp 1888 251D.tmp 2936 256B.tmp 2560 25B9.tmp 2552 2607.tmp 2672 2655.tmp 2664 2694.tmp 2644 26E2.tmp -
Loads dropped DLL 64 IoCs
pid Process 1888 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 2192 12A6.tmp 2552 1304.tmp 2624 1371.tmp 2760 13DE.tmp 2756 143C.tmp 2604 149A.tmp 2660 1507.tmp 2584 1584.tmp 2464 15F1.tmp 2880 164E.tmp 2180 16AC.tmp 1564 170A.tmp 1384 1767.tmp 2656 17D4.tmp 2588 1832.tmp 1460 18AF.tmp 1016 190C.tmp 1948 1989.tmp 284 19F6.tmp 2200 1A64.tmp 1264 1AC1.tmp 1284 1B3E.tmp 2132 1B8C.tmp 2240 1BDA.tmp 2016 1C28.tmp 2068 1C66.tmp 2396 1CA5.tmp 1960 1CF3.tmp 588 1D31.tmp 476 1D7F.tmp 1004 1DBE.tmp 1584 1DFC.tmp 1768 1E3A.tmp 1772 1E79.tmp 1724 1EB7.tmp 2248 1F05.tmp 388 1F53.tmp 2376 1FA1.tmp 3060 1FE0.tmp 2092 202E.tmp 2916 207C.tmp 1212 20BA.tmp 1332 20F8.tmp 1248 2146.tmp 2796 2194.tmp 920 21D3.tmp 1964 2211.tmp 2196 225F.tmp 3008 22AD.tmp 2004 22FB.tmp 2792 233A.tmp 2272 2388.tmp 2260 23C6.tmp 880 2404.tmp 2184 2443.tmp 1520 2481.tmp 1672 24CF.tmp 1888 251D.tmp 2936 256B.tmp 2560 25B9.tmp 2552 2607.tmp 2672 2655.tmp 2664 2694.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2192 1888 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 28 PID 1888 wrote to memory of 2192 1888 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 28 PID 1888 wrote to memory of 2192 1888 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 28 PID 1888 wrote to memory of 2192 1888 2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe 28 PID 2192 wrote to memory of 2552 2192 12A6.tmp 29 PID 2192 wrote to memory of 2552 2192 12A6.tmp 29 PID 2192 wrote to memory of 2552 2192 12A6.tmp 29 PID 2192 wrote to memory of 2552 2192 12A6.tmp 29 PID 2552 wrote to memory of 2624 2552 1304.tmp 30 PID 2552 wrote to memory of 2624 2552 1304.tmp 30 PID 2552 wrote to memory of 2624 2552 1304.tmp 30 PID 2552 wrote to memory of 2624 2552 1304.tmp 30 PID 2624 wrote to memory of 2760 2624 1371.tmp 31 PID 2624 wrote to memory of 2760 2624 1371.tmp 31 PID 2624 wrote to memory of 2760 2624 1371.tmp 31 PID 2624 wrote to memory of 2760 2624 1371.tmp 31 PID 2760 wrote to memory of 2756 2760 13DE.tmp 32 PID 2760 wrote to memory of 2756 2760 13DE.tmp 32 PID 2760 wrote to memory of 2756 2760 13DE.tmp 32 PID 2760 wrote to memory of 2756 2760 13DE.tmp 32 PID 2756 wrote to memory of 2604 2756 143C.tmp 33 PID 2756 wrote to memory of 2604 2756 143C.tmp 33 PID 2756 wrote to memory of 2604 2756 143C.tmp 33 PID 2756 wrote to memory of 2604 2756 143C.tmp 33 PID 2604 wrote to memory of 2660 2604 149A.tmp 34 PID 2604 wrote to memory of 2660 2604 149A.tmp 34 PID 2604 wrote to memory of 2660 2604 149A.tmp 34 PID 2604 wrote to memory of 2660 2604 149A.tmp 34 PID 2660 wrote to memory of 2584 2660 1507.tmp 35 PID 2660 wrote to memory of 2584 2660 1507.tmp 35 PID 2660 wrote to memory of 2584 2660 1507.tmp 35 PID 2660 wrote to memory of 2584 2660 1507.tmp 35 PID 2584 wrote to memory of 2464 2584 1584.tmp 36 PID 2584 wrote to memory of 2464 2584 1584.tmp 36 PID 2584 wrote to memory of 2464 2584 1584.tmp 36 PID 2584 wrote to memory of 2464 2584 1584.tmp 36 PID 2464 wrote to memory of 2880 2464 15F1.tmp 37 PID 2464 wrote to memory of 2880 2464 15F1.tmp 37 PID 2464 wrote to memory of 2880 2464 15F1.tmp 37 PID 2464 wrote to memory of 2880 2464 15F1.tmp 37 PID 2880 wrote to memory of 2180 2880 164E.tmp 38 PID 2880 wrote to memory of 2180 2880 164E.tmp 38 PID 2880 wrote to memory of 2180 2880 164E.tmp 38 PID 2880 wrote to memory of 2180 2880 164E.tmp 38 PID 2180 wrote to memory of 1564 2180 16AC.tmp 39 PID 2180 wrote to memory of 1564 2180 16AC.tmp 39 PID 2180 wrote to memory of 1564 2180 16AC.tmp 39 PID 2180 wrote to memory of 1564 2180 16AC.tmp 39 PID 1564 wrote to memory of 1384 1564 170A.tmp 40 PID 1564 wrote to memory of 1384 1564 170A.tmp 40 PID 1564 wrote to memory of 1384 1564 170A.tmp 40 PID 1564 wrote to memory of 1384 1564 170A.tmp 40 PID 1384 wrote to memory of 2656 1384 1767.tmp 41 PID 1384 wrote to memory of 2656 1384 1767.tmp 41 PID 1384 wrote to memory of 2656 1384 1767.tmp 41 PID 1384 wrote to memory of 2656 1384 1767.tmp 41 PID 2656 wrote to memory of 2588 2656 17D4.tmp 42 PID 2656 wrote to memory of 2588 2656 17D4.tmp 42 PID 2656 wrote to memory of 2588 2656 17D4.tmp 42 PID 2656 wrote to memory of 2588 2656 17D4.tmp 42 PID 2588 wrote to memory of 1460 2588 1832.tmp 43 PID 2588 wrote to memory of 1460 2588 1832.tmp 43 PID 2588 wrote to memory of 1460 2588 1832.tmp 43 PID 2588 wrote to memory of 1460 2588 1832.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_d1230f16348cd8180f106270d9cd2526_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:388 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"66⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"67⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"68⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"70⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"73⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"74⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"75⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"76⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"77⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"78⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"79⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"80⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"81⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"82⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"83⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"84⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"86⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"87⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"88⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"89⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"90⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"91⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"92⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"93⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"94⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"95⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"96⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"97⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"98⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"99⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"100⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"101⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"102⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"103⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"104⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"105⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"106⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"107⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"108⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"109⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"110⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"111⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"112⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"114⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"115⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"116⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"118⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"119⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"120⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"121⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-