Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe
-
Size
520KB
-
MD5
91f8e1efde1fd8a5a846b69b86f4ecf6
-
SHA1
207e993844e4734c225d9c03f0856841a90f71b3
-
SHA256
0fce2e7321578e46c615e59616321ce7c3f629fc0f67679b7704440b8876c84b
-
SHA512
1cdbacf90ff84f8901365ed033ce34c7cb92d0a8b8f7b2b901d8d9c04303691262c5a3ac7fc09b51fca1fbcffcda76621b09c64c7f329cb42a9a271378bf5cfd
-
SSDEEP
12288:gj8fuxR21t5i8fGgK/qTEIVAGiQra/bSQTGNZ:gj8fuK1GYH3YXL/bSQTGN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2352 5BB.tmp 2296 628.tmp 2404 6A5.tmp 2688 712.tmp 2824 78F.tmp 2656 7FC.tmp 2564 83B.tmp 2552 8C7.tmp 1848 934.tmp 2548 9A2.tmp 792 A1E.tmp 1732 A7C.tmp 2892 AE9.tmp 2924 B47.tmp 2468 BB4.tmp 2608 C31.tmp 1972 C9E.tmp 2848 D0B.tmp 1680 D88.tmp 1628 DF5.tmp 2884 E62.tmp 2336 EC0.tmp 1560 F1E.tmp 1196 F6C.tmp 2096 FBA.tmp 2112 FF8.tmp 2500 1036.tmp 2512 1075.tmp 756 10C3.tmp 1756 1101.tmp 320 1140.tmp 768 117E.tmp 1388 11CC.tmp 1644 120A.tmp 536 1249.tmp 812 1287.tmp 2044 12C6.tmp 700 1304.tmp 2328 1352.tmp 1856 1390.tmp 2292 13CF.tmp 1776 140D.tmp 948 145B.tmp 928 149A.tmp 868 14D8.tmp 2976 1516.tmp 2984 1555.tmp 2224 1593.tmp 2940 15D2.tmp 2448 1610.tmp 2620 164E.tmp 352 168D.tmp 2196 16CB.tmp 2324 170A.tmp 856 1748.tmp 1700 1786.tmp 1716 17C5.tmp 1800 1803.tmp 2208 1842.tmp 2632 1880.tmp 2644 18CE.tmp 2680 190C.tmp 2776 194B.tmp 2968 1989.tmp -
Loads dropped DLL 64 IoCs
pid Process 1700 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 2352 5BB.tmp 2296 628.tmp 2404 6A5.tmp 2688 712.tmp 2824 78F.tmp 2656 7FC.tmp 2564 83B.tmp 2552 8C7.tmp 1848 934.tmp 2548 9A2.tmp 792 A1E.tmp 1732 A7C.tmp 2892 AE9.tmp 2924 B47.tmp 2468 BB4.tmp 2608 C31.tmp 1972 C9E.tmp 2848 D0B.tmp 1680 D88.tmp 1628 DF5.tmp 2884 E62.tmp 2336 EC0.tmp 1560 F1E.tmp 1196 F6C.tmp 2096 FBA.tmp 2112 FF8.tmp 2500 1036.tmp 2512 1075.tmp 756 10C3.tmp 1756 1101.tmp 320 1140.tmp 768 117E.tmp 1388 11CC.tmp 1644 120A.tmp 536 1249.tmp 812 1287.tmp 2044 12C6.tmp 700 1304.tmp 2328 1352.tmp 1856 1390.tmp 2292 13CF.tmp 1776 140D.tmp 948 145B.tmp 928 149A.tmp 868 14D8.tmp 2976 1516.tmp 2984 1555.tmp 2224 1593.tmp 2940 15D2.tmp 2448 1610.tmp 2620 164E.tmp 352 168D.tmp 2196 16CB.tmp 2324 170A.tmp 856 1748.tmp 1700 1786.tmp 1716 17C5.tmp 1800 1803.tmp 2208 1842.tmp 2632 1880.tmp 2644 18CE.tmp 2680 190C.tmp 2776 194B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2352 1700 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 28 PID 1700 wrote to memory of 2352 1700 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 28 PID 1700 wrote to memory of 2352 1700 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 28 PID 1700 wrote to memory of 2352 1700 2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe 28 PID 2352 wrote to memory of 2296 2352 5BB.tmp 29 PID 2352 wrote to memory of 2296 2352 5BB.tmp 29 PID 2352 wrote to memory of 2296 2352 5BB.tmp 29 PID 2352 wrote to memory of 2296 2352 5BB.tmp 29 PID 2296 wrote to memory of 2404 2296 628.tmp 30 PID 2296 wrote to memory of 2404 2296 628.tmp 30 PID 2296 wrote to memory of 2404 2296 628.tmp 30 PID 2296 wrote to memory of 2404 2296 628.tmp 30 PID 2404 wrote to memory of 2688 2404 6A5.tmp 31 PID 2404 wrote to memory of 2688 2404 6A5.tmp 31 PID 2404 wrote to memory of 2688 2404 6A5.tmp 31 PID 2404 wrote to memory of 2688 2404 6A5.tmp 31 PID 2688 wrote to memory of 2824 2688 712.tmp 32 PID 2688 wrote to memory of 2824 2688 712.tmp 32 PID 2688 wrote to memory of 2824 2688 712.tmp 32 PID 2688 wrote to memory of 2824 2688 712.tmp 32 PID 2824 wrote to memory of 2656 2824 78F.tmp 33 PID 2824 wrote to memory of 2656 2824 78F.tmp 33 PID 2824 wrote to memory of 2656 2824 78F.tmp 33 PID 2824 wrote to memory of 2656 2824 78F.tmp 33 PID 2656 wrote to memory of 2564 2656 7FC.tmp 34 PID 2656 wrote to memory of 2564 2656 7FC.tmp 34 PID 2656 wrote to memory of 2564 2656 7FC.tmp 34 PID 2656 wrote to memory of 2564 2656 7FC.tmp 34 PID 2564 wrote to memory of 2552 2564 83B.tmp 35 PID 2564 wrote to memory of 2552 2564 83B.tmp 35 PID 2564 wrote to memory of 2552 2564 83B.tmp 35 PID 2564 wrote to memory of 2552 2564 83B.tmp 35 PID 2552 wrote to memory of 1848 2552 8C7.tmp 36 PID 2552 wrote to memory of 1848 2552 8C7.tmp 36 PID 2552 wrote to memory of 1848 2552 8C7.tmp 36 PID 2552 wrote to memory of 1848 2552 8C7.tmp 36 PID 1848 wrote to memory of 2548 1848 934.tmp 37 PID 1848 wrote to memory of 2548 1848 934.tmp 37 PID 1848 wrote to memory of 2548 1848 934.tmp 37 PID 1848 wrote to memory of 2548 1848 934.tmp 37 PID 2548 wrote to memory of 792 2548 9A2.tmp 38 PID 2548 wrote to memory of 792 2548 9A2.tmp 38 PID 2548 wrote to memory of 792 2548 9A2.tmp 38 PID 2548 wrote to memory of 792 2548 9A2.tmp 38 PID 792 wrote to memory of 1732 792 A1E.tmp 39 PID 792 wrote to memory of 1732 792 A1E.tmp 39 PID 792 wrote to memory of 1732 792 A1E.tmp 39 PID 792 wrote to memory of 1732 792 A1E.tmp 39 PID 1732 wrote to memory of 2892 1732 A7C.tmp 40 PID 1732 wrote to memory of 2892 1732 A7C.tmp 40 PID 1732 wrote to memory of 2892 1732 A7C.tmp 40 PID 1732 wrote to memory of 2892 1732 A7C.tmp 40 PID 2892 wrote to memory of 2924 2892 AE9.tmp 41 PID 2892 wrote to memory of 2924 2892 AE9.tmp 41 PID 2892 wrote to memory of 2924 2892 AE9.tmp 41 PID 2892 wrote to memory of 2924 2892 AE9.tmp 41 PID 2924 wrote to memory of 2468 2924 B47.tmp 42 PID 2924 wrote to memory of 2468 2924 B47.tmp 42 PID 2924 wrote to memory of 2468 2924 B47.tmp 42 PID 2924 wrote to memory of 2468 2924 B47.tmp 42 PID 2468 wrote to memory of 2608 2468 BB4.tmp 43 PID 2468 wrote to memory of 2608 2468 BB4.tmp 43 PID 2468 wrote to memory of 2608 2468 BB4.tmp 43 PID 2468 wrote to memory of 2608 2468 BB4.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-25_91f8e1efde1fd8a5a846b69b86f4ecf6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"65⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"68⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"69⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"70⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"71⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"73⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"74⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"75⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"76⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"77⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"79⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"80⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"81⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"82⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"83⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"84⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"85⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"86⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"87⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"88⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"89⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"90⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"91⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"92⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"93⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"94⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"95⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"96⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"97⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"99⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"100⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"101⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"102⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"103⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"104⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"105⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"106⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"107⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"108⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"109⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"112⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"113⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"115⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"116⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"117⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"118⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"119⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"120⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"121⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"122⤵PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-