Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe
-
Size
520KB
-
MD5
709b78e81e1f55ff29907adafe63052a
-
SHA1
96bca3ef556071527529f75c21207fbfadfcae4f
-
SHA256
12e0404251cb3b957842fa00377029f8b1533071a11646bea753277fb5d96347
-
SHA512
665e8345625d4880528c0140b310c89c423af52d55469f184d70472e04583c4572177c47145d9c61d61317647eae612b0e81378eb27ede5bd251a0647a962733
-
SSDEEP
12288:gj8fuxR21t5i8f3UrFvfC/f7JsyyRhl0dUKNZ:gj8fuK1GY3EB275yRhCHN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2952 1DDD.tmp 2740 1E3A.tmp 2304 1EF6.tmp 2648 1F72.tmp 2596 1FE0.tmp 2716 205C.tmp 2720 20E9.tmp 2976 2166.tmp 2496 21A4.tmp 2492 2250.tmp 2896 22CC.tmp 2908 2359.tmp 2776 23E5.tmp 2892 2491.tmp 2928 24FE.tmp 2152 259A.tmp 1048 2626.tmp 2508 26C2.tmp 1608 274F.tmp 2428 27EB.tmp 2696 2858.tmp 1348 28F4.tmp 1428 2971.tmp 1768 29AF.tmp 1724 29FD.tmp 2324 2A3C.tmp 2136 2A99.tmp 2080 2AD8.tmp 2848 2B26.tmp 2312 2B74.tmp 784 2BB2.tmp 1164 2BF0.tmp 1356 2C3E.tmp 1488 2C7D.tmp 1888 2CBB.tmp 1240 2CFA.tmp 1816 2D48.tmp 1088 2D96.tmp 2384 2DD4.tmp 828 2E12.tmp 1400 2E60.tmp 1808 2EBE.tmp 960 2EFC.tmp 1860 2F4A.tmp 620 2F89.tmp 2016 2FD7.tmp 964 3025.tmp 3044 3073.tmp 2180 30D0.tmp 832 312E.tmp 664 31BA.tmp 2040 3208.tmp 1748 3256.tmp 2864 32B4.tmp 1848 3302.tmp 1560 338E.tmp 2308 33EC.tmp 2532 343A.tmp 2740 3488.tmp 2636 34D6.tmp 2668 3524.tmp 2656 3562.tmp 2596 35A1.tmp 2712 35EF.tmp -
Loads dropped DLL 64 IoCs
pid Process 2524 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 2952 1DDD.tmp 2740 1E3A.tmp 2304 1EF6.tmp 2648 1F72.tmp 2596 1FE0.tmp 2716 205C.tmp 2720 20E9.tmp 2976 2166.tmp 2496 21A4.tmp 2492 2250.tmp 2896 22CC.tmp 2908 2359.tmp 2776 23E5.tmp 2892 2491.tmp 2928 24FE.tmp 2152 259A.tmp 1048 2626.tmp 2508 26C2.tmp 1608 274F.tmp 2428 27EB.tmp 2696 2858.tmp 1348 28F4.tmp 1428 2971.tmp 1768 29AF.tmp 1724 29FD.tmp 2324 2A3C.tmp 2136 2A99.tmp 2080 2AD8.tmp 2848 2B26.tmp 2312 2B74.tmp 784 2BB2.tmp 1164 2BF0.tmp 1356 2C3E.tmp 1488 2C7D.tmp 1888 2CBB.tmp 1240 2CFA.tmp 1816 2D48.tmp 1088 2D96.tmp 2384 2DD4.tmp 828 2E12.tmp 1400 2E60.tmp 1808 2EBE.tmp 960 2EFC.tmp 1860 2F4A.tmp 620 2F89.tmp 2016 2FD7.tmp 964 3025.tmp 3044 3073.tmp 2180 30D0.tmp 832 312E.tmp 664 31BA.tmp 2040 3208.tmp 1748 3256.tmp 2864 32B4.tmp 1584 3350.tmp 1560 338E.tmp 2308 33EC.tmp 2532 343A.tmp 2740 3488.tmp 2636 34D6.tmp 2668 3524.tmp 2656 3562.tmp 2596 35A1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2952 2524 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 28 PID 2524 wrote to memory of 2952 2524 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 28 PID 2524 wrote to memory of 2952 2524 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 28 PID 2524 wrote to memory of 2952 2524 2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe 28 PID 2952 wrote to memory of 2740 2952 1DDD.tmp 29 PID 2952 wrote to memory of 2740 2952 1DDD.tmp 29 PID 2952 wrote to memory of 2740 2952 1DDD.tmp 29 PID 2952 wrote to memory of 2740 2952 1DDD.tmp 29 PID 2740 wrote to memory of 2304 2740 1E3A.tmp 30 PID 2740 wrote to memory of 2304 2740 1E3A.tmp 30 PID 2740 wrote to memory of 2304 2740 1E3A.tmp 30 PID 2740 wrote to memory of 2304 2740 1E3A.tmp 30 PID 2304 wrote to memory of 2648 2304 1EF6.tmp 31 PID 2304 wrote to memory of 2648 2304 1EF6.tmp 31 PID 2304 wrote to memory of 2648 2304 1EF6.tmp 31 PID 2304 wrote to memory of 2648 2304 1EF6.tmp 31 PID 2648 wrote to memory of 2596 2648 1F72.tmp 32 PID 2648 wrote to memory of 2596 2648 1F72.tmp 32 PID 2648 wrote to memory of 2596 2648 1F72.tmp 32 PID 2648 wrote to memory of 2596 2648 1F72.tmp 32 PID 2596 wrote to memory of 2716 2596 1FE0.tmp 33 PID 2596 wrote to memory of 2716 2596 1FE0.tmp 33 PID 2596 wrote to memory of 2716 2596 1FE0.tmp 33 PID 2596 wrote to memory of 2716 2596 1FE0.tmp 33 PID 2716 wrote to memory of 2720 2716 205C.tmp 34 PID 2716 wrote to memory of 2720 2716 205C.tmp 34 PID 2716 wrote to memory of 2720 2716 205C.tmp 34 PID 2716 wrote to memory of 2720 2716 205C.tmp 34 PID 2720 wrote to memory of 2976 2720 20E9.tmp 35 PID 2720 wrote to memory of 2976 2720 20E9.tmp 35 PID 2720 wrote to memory of 2976 2720 20E9.tmp 35 PID 2720 wrote to memory of 2976 2720 20E9.tmp 35 PID 2976 wrote to memory of 2496 2976 2166.tmp 36 PID 2976 wrote to memory of 2496 2976 2166.tmp 36 PID 2976 wrote to memory of 2496 2976 2166.tmp 36 PID 2976 wrote to memory of 2496 2976 2166.tmp 36 PID 2496 wrote to memory of 2492 2496 21A4.tmp 37 PID 2496 wrote to memory of 2492 2496 21A4.tmp 37 PID 2496 wrote to memory of 2492 2496 21A4.tmp 37 PID 2496 wrote to memory of 2492 2496 21A4.tmp 37 PID 2492 wrote to memory of 2896 2492 2250.tmp 38 PID 2492 wrote to memory of 2896 2492 2250.tmp 38 PID 2492 wrote to memory of 2896 2492 2250.tmp 38 PID 2492 wrote to memory of 2896 2492 2250.tmp 38 PID 2896 wrote to memory of 2908 2896 22CC.tmp 39 PID 2896 wrote to memory of 2908 2896 22CC.tmp 39 PID 2896 wrote to memory of 2908 2896 22CC.tmp 39 PID 2896 wrote to memory of 2908 2896 22CC.tmp 39 PID 2908 wrote to memory of 2776 2908 2359.tmp 40 PID 2908 wrote to memory of 2776 2908 2359.tmp 40 PID 2908 wrote to memory of 2776 2908 2359.tmp 40 PID 2908 wrote to memory of 2776 2908 2359.tmp 40 PID 2776 wrote to memory of 2892 2776 23E5.tmp 41 PID 2776 wrote to memory of 2892 2776 23E5.tmp 41 PID 2776 wrote to memory of 2892 2776 23E5.tmp 41 PID 2776 wrote to memory of 2892 2776 23E5.tmp 41 PID 2892 wrote to memory of 2928 2892 2491.tmp 42 PID 2892 wrote to memory of 2928 2892 2491.tmp 42 PID 2892 wrote to memory of 2928 2892 2491.tmp 42 PID 2892 wrote to memory of 2928 2892 2491.tmp 42 PID 2928 wrote to memory of 2152 2928 24FE.tmp 43 PID 2928 wrote to memory of 2152 2928 24FE.tmp 43 PID 2928 wrote to memory of 2152 2928 24FE.tmp 43 PID 2928 wrote to memory of 2152 2928 24FE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_709b78e81e1f55ff29907adafe63052a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"56⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"57⤵
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"66⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"69⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"70⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"72⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"73⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"74⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"75⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"76⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"77⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"78⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"79⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"80⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"81⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"82⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"83⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"84⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"85⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"86⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"87⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"88⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"89⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"90⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"91⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"92⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"93⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"94⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"95⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"96⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"97⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"98⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"99⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"100⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"101⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"103⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"104⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"105⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"106⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"107⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"108⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"109⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"110⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"111⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"112⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"113⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"114⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"115⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"116⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"117⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"118⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"119⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"120⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"121⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"122⤵PID:1032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-