Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe
-
Size
536KB
-
MD5
5d30268c2643e1162b11c5d6d4941018
-
SHA1
dc49e24ad9e3bf8ea260f86cadd1335d977e9694
-
SHA256
8c2a09a90d6563f607a25a7d543d61e82758dfd040237c4659da3bb723cfbcd3
-
SHA512
7dca9045b14d9c035c0eeb00fbc994d68da00bd5aef40b4a32cfde8fff5a13a5c7b1d65e1c55d19978dafcb20fa1b2a41f5047a943a221b712ecf5d47181fa17
-
SSDEEP
12288:wU5rCOTeiUww5CX7Wy13r45gOwrEjeYIZxVJ0ZT9:wUQOJU/9yF0iO7jHIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1848 26E2.tmp 1696 2720.tmp 2856 275E.tmp 2448 279D.tmp 2756 27DB.tmp 2612 2829.tmp 2620 2868.tmp 2700 28B6.tmp 2424 2904.tmp 2536 2961.tmp 2948 29BF.tmp 1572 2A1C.tmp 748 2A6A.tmp 1748 2AA9.tmp 1792 2AF7.tmp 744 2B45.tmp 1536 2BA2.tmp 668 2BF0.tmp 1480 2C3E.tmp 1320 2C8C.tmp 2740 2CDA.tmp 2736 2D38.tmp 2276 2D86.tmp 2272 2DD4.tmp 2852 2E22.tmp 1288 2E70.tmp 1084 2EBE.tmp 2288 2F0C.tmp 1988 2F6A.tmp 828 2FB8.tmp 1664 3006.tmp 1380 3044.tmp 328 3082.tmp 1300 30C1.tmp 564 30FF.tmp 1048 313E.tmp 1928 317C.tmp 2044 31BA.tmp 3036 3208.tmp 1496 3247.tmp 800 3295.tmp 1252 32F2.tmp 1704 3340.tmp 1736 338E.tmp 2644 33DC.tmp 2808 342A.tmp 2868 3478.tmp 2532 34B7.tmp 2576 34F5.tmp 2144 3534.tmp 2464 3572.tmp 304 35B0.tmp 2004 35EF.tmp 2668 363D.tmp 2504 368B.tmp 2568 36D9.tmp 1756 3717.tmp 2956 3756.tmp 1548 3794.tmp 2960 37E2.tmp 1820 3830.tmp 2136 386E.tmp 2336 38AD.tmp 1860 38EB.tmp -
Loads dropped DLL 64 IoCs
pid Process 1252 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 1848 26E2.tmp 1696 2720.tmp 2856 275E.tmp 2448 279D.tmp 2756 27DB.tmp 2612 2829.tmp 2620 2868.tmp 2700 28B6.tmp 2424 2904.tmp 2536 2961.tmp 2948 29BF.tmp 1572 2A1C.tmp 748 2A6A.tmp 1748 2AA9.tmp 1792 2AF7.tmp 744 2B45.tmp 1536 2BA2.tmp 668 2BF0.tmp 1480 2C3E.tmp 1320 2C8C.tmp 2740 2CDA.tmp 2736 2D38.tmp 2276 2D86.tmp 2272 2DD4.tmp 2852 2E22.tmp 1288 2E70.tmp 1084 2EBE.tmp 2288 2F0C.tmp 1988 2F6A.tmp 828 2FB8.tmp 1664 3006.tmp 1380 3044.tmp 328 3082.tmp 1300 30C1.tmp 564 30FF.tmp 1048 313E.tmp 1928 317C.tmp 2044 31BA.tmp 3036 3208.tmp 1496 3247.tmp 800 3295.tmp 1252 32F2.tmp 1704 3340.tmp 1736 338E.tmp 2644 33DC.tmp 2808 342A.tmp 2868 3478.tmp 2532 34B7.tmp 2576 34F5.tmp 2144 3534.tmp 2464 3572.tmp 304 35B0.tmp 2004 35EF.tmp 2668 363D.tmp 2504 368B.tmp 2568 36D9.tmp 1756 3717.tmp 2956 3756.tmp 1548 3794.tmp 2960 37E2.tmp 1820 3830.tmp 2136 386E.tmp 2336 38AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1848 1252 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 28 PID 1252 wrote to memory of 1848 1252 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 28 PID 1252 wrote to memory of 1848 1252 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 28 PID 1252 wrote to memory of 1848 1252 2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe 28 PID 1848 wrote to memory of 1696 1848 26E2.tmp 29 PID 1848 wrote to memory of 1696 1848 26E2.tmp 29 PID 1848 wrote to memory of 1696 1848 26E2.tmp 29 PID 1848 wrote to memory of 1696 1848 26E2.tmp 29 PID 1696 wrote to memory of 2856 1696 2720.tmp 30 PID 1696 wrote to memory of 2856 1696 2720.tmp 30 PID 1696 wrote to memory of 2856 1696 2720.tmp 30 PID 1696 wrote to memory of 2856 1696 2720.tmp 30 PID 2856 wrote to memory of 2448 2856 275E.tmp 31 PID 2856 wrote to memory of 2448 2856 275E.tmp 31 PID 2856 wrote to memory of 2448 2856 275E.tmp 31 PID 2856 wrote to memory of 2448 2856 275E.tmp 31 PID 2448 wrote to memory of 2756 2448 279D.tmp 32 PID 2448 wrote to memory of 2756 2448 279D.tmp 32 PID 2448 wrote to memory of 2756 2448 279D.tmp 32 PID 2448 wrote to memory of 2756 2448 279D.tmp 32 PID 2756 wrote to memory of 2612 2756 27DB.tmp 33 PID 2756 wrote to memory of 2612 2756 27DB.tmp 33 PID 2756 wrote to memory of 2612 2756 27DB.tmp 33 PID 2756 wrote to memory of 2612 2756 27DB.tmp 33 PID 2612 wrote to memory of 2620 2612 2829.tmp 34 PID 2612 wrote to memory of 2620 2612 2829.tmp 34 PID 2612 wrote to memory of 2620 2612 2829.tmp 34 PID 2612 wrote to memory of 2620 2612 2829.tmp 34 PID 2620 wrote to memory of 2700 2620 2868.tmp 35 PID 2620 wrote to memory of 2700 2620 2868.tmp 35 PID 2620 wrote to memory of 2700 2620 2868.tmp 35 PID 2620 wrote to memory of 2700 2620 2868.tmp 35 PID 2700 wrote to memory of 2424 2700 28B6.tmp 36 PID 2700 wrote to memory of 2424 2700 28B6.tmp 36 PID 2700 wrote to memory of 2424 2700 28B6.tmp 36 PID 2700 wrote to memory of 2424 2700 28B6.tmp 36 PID 2424 wrote to memory of 2536 2424 2904.tmp 37 PID 2424 wrote to memory of 2536 2424 2904.tmp 37 PID 2424 wrote to memory of 2536 2424 2904.tmp 37 PID 2424 wrote to memory of 2536 2424 2904.tmp 37 PID 2536 wrote to memory of 2948 2536 2961.tmp 38 PID 2536 wrote to memory of 2948 2536 2961.tmp 38 PID 2536 wrote to memory of 2948 2536 2961.tmp 38 PID 2536 wrote to memory of 2948 2536 2961.tmp 38 PID 2948 wrote to memory of 1572 2948 29BF.tmp 39 PID 2948 wrote to memory of 1572 2948 29BF.tmp 39 PID 2948 wrote to memory of 1572 2948 29BF.tmp 39 PID 2948 wrote to memory of 1572 2948 29BF.tmp 39 PID 1572 wrote to memory of 748 1572 2A1C.tmp 40 PID 1572 wrote to memory of 748 1572 2A1C.tmp 40 PID 1572 wrote to memory of 748 1572 2A1C.tmp 40 PID 1572 wrote to memory of 748 1572 2A1C.tmp 40 PID 748 wrote to memory of 1748 748 2A6A.tmp 41 PID 748 wrote to memory of 1748 748 2A6A.tmp 41 PID 748 wrote to memory of 1748 748 2A6A.tmp 41 PID 748 wrote to memory of 1748 748 2A6A.tmp 41 PID 1748 wrote to memory of 1792 1748 2AA9.tmp 42 PID 1748 wrote to memory of 1792 1748 2AA9.tmp 42 PID 1748 wrote to memory of 1792 1748 2AA9.tmp 42 PID 1748 wrote to memory of 1792 1748 2AA9.tmp 42 PID 1792 wrote to memory of 744 1792 2AF7.tmp 43 PID 1792 wrote to memory of 744 1792 2AF7.tmp 43 PID 1792 wrote to memory of 744 1792 2AF7.tmp 43 PID 1792 wrote to memory of 744 1792 2AF7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_5d30268c2643e1162b11c5d6d4941018_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"65⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"66⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"67⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"68⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"69⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"70⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"71⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"72⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"73⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"74⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"75⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"76⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"77⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"78⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"79⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"80⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"81⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"82⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"83⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"84⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"85⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"86⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"87⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"89⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"90⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"91⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"92⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"93⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"94⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"95⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"96⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"97⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"98⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"99⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"100⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"101⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"102⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"103⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"104⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"105⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"106⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"107⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"108⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"109⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"110⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"111⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"112⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"113⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"114⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"115⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"116⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"117⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"118⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"119⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"120⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"122⤵PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-