Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe
-
Size
536KB
-
MD5
41040754db89ba683ca0b2799de1175f
-
SHA1
c909f72437a3ae07352fda3b98ad05ed3485c910
-
SHA256
81a89c30a966a9bdb70c9d3afd361fca81f9a0775e81ce6e36b8c5c420d0bc1d
-
SHA512
8ce8db55fa2efeaf07bb347e3d95f71b9c52459a15cc64383eec88c54c4a6674864db4f7bbf5393aee6a6c338fc5958416e8c19c748e18cb1bf8ba06b2d38442
-
SSDEEP
12288:wU5rCOTeiU/EtEnUI+Edzp0jMqZSNl3+PIZxVJ0ZT9:wUQOJUcWnUWdF0jMqZIQIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2604 F2D.tmp 2540 F7B.tmp 2564 FBA.tmp 1280 1008.tmp 1312 1056.tmp 2580 10C3.tmp 2432 1111.tmp 2908 115F.tmp 1920 119D.tmp 2772 11DC.tmp 2804 1239.tmp 112 1278.tmp 1696 12C6.tmp 1672 1304.tmp 1360 1371.tmp 1504 13DE.tmp 1336 142C.tmp 1964 147A.tmp 2248 14B9.tmp 2396 1507.tmp 2852 1593.tmp 1072 15F1.tmp 1692 162F.tmp 1720 16AC.tmp 604 16EA.tmp 2212 1738.tmp 2940 1777.tmp 3012 17C5.tmp 1472 1803.tmp 1992 1842.tmp 1648 1880.tmp 2308 18CE.tmp 2028 191C.tmp 1740 195A.tmp 1624 19A8.tmp 2056 19E7.tmp 1652 1A25.tmp 1944 1A64.tmp 2328 1AA2.tmp 2332 1AE0.tmp 2992 1B2E.tmp 2516 1B7C.tmp 2420 1BBB.tmp 2588 1C09.tmp 2712 1C47.tmp 2628 1C86.tmp 2580 1CC4.tmp 2064 1D02.tmp 2908 1D31.tmp 2704 1D70.tmp 2572 1DAE.tmp 2756 1DEC.tmp 1664 1E1B.tmp 1696 1E5A.tmp 1896 1E98.tmp 1892 1ED6.tmp 1360 1F15.tmp 1600 1F53.tmp 2224 1F92.tmp 1244 1FD0.tmp 1832 200E.tmp 2668 204D.tmp 2300 208B.tmp 2852 20CA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2972 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 2604 F2D.tmp 2540 F7B.tmp 2564 FBA.tmp 1280 1008.tmp 1312 1056.tmp 2580 10C3.tmp 2432 1111.tmp 2908 115F.tmp 1920 119D.tmp 2772 11DC.tmp 2804 1239.tmp 112 1278.tmp 1696 12C6.tmp 1672 1304.tmp 1360 1371.tmp 1504 13DE.tmp 1336 142C.tmp 1964 147A.tmp 2248 14B9.tmp 2396 1507.tmp 2852 1593.tmp 1072 15F1.tmp 1692 162F.tmp 1720 16AC.tmp 604 16EA.tmp 2212 1738.tmp 2940 1777.tmp 3012 17C5.tmp 1472 1803.tmp 1992 1842.tmp 1648 1880.tmp 2308 18CE.tmp 2028 191C.tmp 1740 195A.tmp 1624 19A8.tmp 2056 19E7.tmp 1652 1A25.tmp 1944 1A64.tmp 2328 1AA2.tmp 2332 1AE0.tmp 2992 1B2E.tmp 2516 1B7C.tmp 2420 1BBB.tmp 2588 1C09.tmp 2712 1C47.tmp 2628 1C86.tmp 2580 1CC4.tmp 2064 1D02.tmp 2908 1D31.tmp 2704 1D70.tmp 2572 1DAE.tmp 2756 1DEC.tmp 1664 1E1B.tmp 1696 1E5A.tmp 1896 1E98.tmp 1892 1ED6.tmp 1360 1F15.tmp 1600 1F53.tmp 2224 1F92.tmp 1244 1FD0.tmp 1832 200E.tmp 2668 204D.tmp 2300 208B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2604 2972 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 110 PID 2972 wrote to memory of 2604 2972 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 110 PID 2972 wrote to memory of 2604 2972 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 110 PID 2972 wrote to memory of 2604 2972 2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe 110 PID 2604 wrote to memory of 2540 2604 F2D.tmp 29 PID 2604 wrote to memory of 2540 2604 F2D.tmp 29 PID 2604 wrote to memory of 2540 2604 F2D.tmp 29 PID 2604 wrote to memory of 2540 2604 F2D.tmp 29 PID 2540 wrote to memory of 2564 2540 F7B.tmp 30 PID 2540 wrote to memory of 2564 2540 F7B.tmp 30 PID 2540 wrote to memory of 2564 2540 F7B.tmp 30 PID 2540 wrote to memory of 2564 2540 F7B.tmp 30 PID 2564 wrote to memory of 1280 2564 FBA.tmp 31 PID 2564 wrote to memory of 1280 2564 FBA.tmp 31 PID 2564 wrote to memory of 1280 2564 FBA.tmp 31 PID 2564 wrote to memory of 1280 2564 FBA.tmp 31 PID 1280 wrote to memory of 1312 1280 1008.tmp 32 PID 1280 wrote to memory of 1312 1280 1008.tmp 32 PID 1280 wrote to memory of 1312 1280 1008.tmp 32 PID 1280 wrote to memory of 1312 1280 1008.tmp 32 PID 1312 wrote to memory of 2580 1312 1056.tmp 33 PID 1312 wrote to memory of 2580 1312 1056.tmp 33 PID 1312 wrote to memory of 2580 1312 1056.tmp 33 PID 1312 wrote to memory of 2580 1312 1056.tmp 33 PID 2580 wrote to memory of 2432 2580 10C3.tmp 34 PID 2580 wrote to memory of 2432 2580 10C3.tmp 34 PID 2580 wrote to memory of 2432 2580 10C3.tmp 34 PID 2580 wrote to memory of 2432 2580 10C3.tmp 34 PID 2432 wrote to memory of 2908 2432 1111.tmp 35 PID 2432 wrote to memory of 2908 2432 1111.tmp 35 PID 2432 wrote to memory of 2908 2432 1111.tmp 35 PID 2432 wrote to memory of 2908 2432 1111.tmp 35 PID 2908 wrote to memory of 1920 2908 115F.tmp 36 PID 2908 wrote to memory of 1920 2908 115F.tmp 36 PID 2908 wrote to memory of 1920 2908 115F.tmp 36 PID 2908 wrote to memory of 1920 2908 115F.tmp 36 PID 1920 wrote to memory of 2772 1920 119D.tmp 37 PID 1920 wrote to memory of 2772 1920 119D.tmp 37 PID 1920 wrote to memory of 2772 1920 119D.tmp 37 PID 1920 wrote to memory of 2772 1920 119D.tmp 37 PID 2772 wrote to memory of 2804 2772 11DC.tmp 38 PID 2772 wrote to memory of 2804 2772 11DC.tmp 38 PID 2772 wrote to memory of 2804 2772 11DC.tmp 38 PID 2772 wrote to memory of 2804 2772 11DC.tmp 38 PID 2804 wrote to memory of 112 2804 1239.tmp 39 PID 2804 wrote to memory of 112 2804 1239.tmp 39 PID 2804 wrote to memory of 112 2804 1239.tmp 39 PID 2804 wrote to memory of 112 2804 1239.tmp 39 PID 112 wrote to memory of 1696 112 1278.tmp 40 PID 112 wrote to memory of 1696 112 1278.tmp 40 PID 112 wrote to memory of 1696 112 1278.tmp 40 PID 112 wrote to memory of 1696 112 1278.tmp 40 PID 1696 wrote to memory of 1672 1696 12C6.tmp 41 PID 1696 wrote to memory of 1672 1696 12C6.tmp 41 PID 1696 wrote to memory of 1672 1696 12C6.tmp 41 PID 1696 wrote to memory of 1672 1696 12C6.tmp 41 PID 1672 wrote to memory of 1360 1672 1304.tmp 42 PID 1672 wrote to memory of 1360 1672 1304.tmp 42 PID 1672 wrote to memory of 1360 1672 1304.tmp 42 PID 1672 wrote to memory of 1360 1672 1304.tmp 42 PID 1360 wrote to memory of 1504 1360 1371.tmp 43 PID 1360 wrote to memory of 1504 1360 1371.tmp 43 PID 1360 wrote to memory of 1504 1360 1371.tmp 43 PID 1360 wrote to memory of 1504 1360 1371.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_41040754db89ba683ca0b2799de1175f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"65⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"66⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"67⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"68⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"69⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"70⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"71⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"72⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"73⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"74⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"75⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"76⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"77⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"78⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"79⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"80⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"81⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"82⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"83⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"84⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"85⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"86⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"87⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"88⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"89⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"90⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"91⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"92⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"93⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"94⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"95⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"96⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"97⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"98⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"99⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"100⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"101⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"102⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"103⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"104⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"105⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"106⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"107⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"108⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"109⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"110⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"112⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"113⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"114⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"115⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"116⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"117⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"118⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"119⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"120⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-