Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/07/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe
-
Size
530KB
-
MD5
4dc76e309bc6c39378196f120267d5e3
-
SHA1
14edb40a9d3b3e335587b42a1c73a6ffb64ebb88
-
SHA256
aa08d44a3afccdf5c1b84afd3323a71e7ef4f73f3457ba6008673ce30849376a
-
SHA512
7753aa3dec501e218704a1137403acdc4a43929c35c70ba3367bd3392fa835269241311198b0fad5cc5c46d0b642ad639ba1bf2c3a62ec38d630f0db36021e94
-
SSDEEP
12288:AU5rCOTeio4/cGRpIkPI/Xg42GD8m/4T8NZulFVg0M1:AUQOJoELpk/wYQmQT8NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2104 B606.tmp 2136 B664.tmp 2424 B6D1.tmp 868 B72F.tmp 2696 B7AB.tmp 2748 B7EA.tmp 2840 B847.tmp 2988 B895.tmp 2844 B903.tmp 2628 B960.tmp 2648 B9AE.tmp 2620 B9FC.tmp 2544 BA89.tmp 2772 BAC7.tmp 1748 BB05.tmp 700 BB44.tmp 1864 BB92.tmp 1256 BBD0.tmp 1476 BC0F.tmp 1984 BCCA.tmp 1788 BD27.tmp 108 BD66.tmp 548 BDA4.tmp 2928 BDF2.tmp 560 BE50.tmp 2004 BE8E.tmp 2924 BECD.tmp 2700 BF0B.tmp 2892 BF49.tmp 2152 BF88.tmp 656 BFC6.tmp 1100 BFF5.tmp 2488 C033.tmp 832 C072.tmp 1628 C0B0.tmp 1868 C0EF.tmp 872 C12D.tmp 1744 C15C.tmp 1736 C1AA.tmp 916 C1E8.tmp 1804 C236.tmp 2484 C294.tmp 580 C2E2.tmp 2980 C330.tmp 1764 C36E.tmp 984 C3AD.tmp 992 C40A.tmp 2400 C449.tmp 1524 C497.tmp 2212 C4F4.tmp 2272 C533.tmp 2100 C571.tmp 1608 C5AF.tmp 3036 C5EE.tmp 2188 C62C.tmp 2412 C66B.tmp 2184 C6B9.tmp 2820 C6F7.tmp 2972 C735.tmp 2888 C774.tmp 2696 C7C2.tmp 2732 C800.tmp 2728 C83F.tmp 2808 C87D.tmp -
Loads dropped DLL 64 IoCs
pid Process 3032 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 2104 B606.tmp 2136 B664.tmp 2424 B6D1.tmp 868 B72F.tmp 2696 B7AB.tmp 2748 B7EA.tmp 2840 B847.tmp 2988 B895.tmp 2844 B903.tmp 2628 B960.tmp 2648 B9AE.tmp 2620 B9FC.tmp 2544 BA89.tmp 2772 BAC7.tmp 1748 BB05.tmp 700 BB44.tmp 1864 BB92.tmp 1256 BBD0.tmp 1476 BC0F.tmp 1984 BCCA.tmp 1788 BD27.tmp 108 BD66.tmp 548 BDA4.tmp 2928 BDF2.tmp 560 BE50.tmp 2004 BE8E.tmp 2924 BECD.tmp 2700 BF0B.tmp 2892 BF49.tmp 2152 BF88.tmp 656 BFC6.tmp 1100 BFF5.tmp 2488 C033.tmp 832 C072.tmp 1628 C0B0.tmp 1868 C0EF.tmp 872 C12D.tmp 1744 C15C.tmp 1736 C1AA.tmp 916 C1E8.tmp 1804 C236.tmp 2484 C294.tmp 580 C2E2.tmp 2980 C330.tmp 1764 C36E.tmp 984 C3AD.tmp 992 C40A.tmp 2400 C449.tmp 1524 C497.tmp 2212 C4F4.tmp 2272 C533.tmp 2100 C571.tmp 1608 C5AF.tmp 3036 C5EE.tmp 2188 C62C.tmp 2412 C66B.tmp 2184 C6B9.tmp 2820 C6F7.tmp 2972 C735.tmp 2888 C774.tmp 2696 C7C2.tmp 2732 C800.tmp 2728 C83F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2104 3032 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 30 PID 3032 wrote to memory of 2104 3032 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 30 PID 3032 wrote to memory of 2104 3032 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 30 PID 3032 wrote to memory of 2104 3032 2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe 30 PID 2104 wrote to memory of 2136 2104 B606.tmp 31 PID 2104 wrote to memory of 2136 2104 B606.tmp 31 PID 2104 wrote to memory of 2136 2104 B606.tmp 31 PID 2104 wrote to memory of 2136 2104 B606.tmp 31 PID 2136 wrote to memory of 2424 2136 B664.tmp 32 PID 2136 wrote to memory of 2424 2136 B664.tmp 32 PID 2136 wrote to memory of 2424 2136 B664.tmp 32 PID 2136 wrote to memory of 2424 2136 B664.tmp 32 PID 2424 wrote to memory of 868 2424 B6D1.tmp 33 PID 2424 wrote to memory of 868 2424 B6D1.tmp 33 PID 2424 wrote to memory of 868 2424 B6D1.tmp 33 PID 2424 wrote to memory of 868 2424 B6D1.tmp 33 PID 868 wrote to memory of 2696 868 B72F.tmp 34 PID 868 wrote to memory of 2696 868 B72F.tmp 34 PID 868 wrote to memory of 2696 868 B72F.tmp 34 PID 868 wrote to memory of 2696 868 B72F.tmp 34 PID 2696 wrote to memory of 2748 2696 B7AB.tmp 35 PID 2696 wrote to memory of 2748 2696 B7AB.tmp 35 PID 2696 wrote to memory of 2748 2696 B7AB.tmp 35 PID 2696 wrote to memory of 2748 2696 B7AB.tmp 35 PID 2748 wrote to memory of 2840 2748 B7EA.tmp 36 PID 2748 wrote to memory of 2840 2748 B7EA.tmp 36 PID 2748 wrote to memory of 2840 2748 B7EA.tmp 36 PID 2748 wrote to memory of 2840 2748 B7EA.tmp 36 PID 2840 wrote to memory of 2988 2840 B847.tmp 37 PID 2840 wrote to memory of 2988 2840 B847.tmp 37 PID 2840 wrote to memory of 2988 2840 B847.tmp 37 PID 2840 wrote to memory of 2988 2840 B847.tmp 37 PID 2988 wrote to memory of 2844 2988 B895.tmp 38 PID 2988 wrote to memory of 2844 2988 B895.tmp 38 PID 2988 wrote to memory of 2844 2988 B895.tmp 38 PID 2988 wrote to memory of 2844 2988 B895.tmp 38 PID 2844 wrote to memory of 2628 2844 B903.tmp 39 PID 2844 wrote to memory of 2628 2844 B903.tmp 39 PID 2844 wrote to memory of 2628 2844 B903.tmp 39 PID 2844 wrote to memory of 2628 2844 B903.tmp 39 PID 2628 wrote to memory of 2648 2628 B960.tmp 40 PID 2628 wrote to memory of 2648 2628 B960.tmp 40 PID 2628 wrote to memory of 2648 2628 B960.tmp 40 PID 2628 wrote to memory of 2648 2628 B960.tmp 40 PID 2648 wrote to memory of 2620 2648 B9AE.tmp 41 PID 2648 wrote to memory of 2620 2648 B9AE.tmp 41 PID 2648 wrote to memory of 2620 2648 B9AE.tmp 41 PID 2648 wrote to memory of 2620 2648 B9AE.tmp 41 PID 2620 wrote to memory of 2544 2620 B9FC.tmp 42 PID 2620 wrote to memory of 2544 2620 B9FC.tmp 42 PID 2620 wrote to memory of 2544 2620 B9FC.tmp 42 PID 2620 wrote to memory of 2544 2620 B9FC.tmp 42 PID 2544 wrote to memory of 2772 2544 BA89.tmp 43 PID 2544 wrote to memory of 2772 2544 BA89.tmp 43 PID 2544 wrote to memory of 2772 2544 BA89.tmp 43 PID 2544 wrote to memory of 2772 2544 BA89.tmp 43 PID 2772 wrote to memory of 1748 2772 BAC7.tmp 44 PID 2772 wrote to memory of 1748 2772 BAC7.tmp 44 PID 2772 wrote to memory of 1748 2772 BAC7.tmp 44 PID 2772 wrote to memory of 1748 2772 BAC7.tmp 44 PID 1748 wrote to memory of 700 1748 BB05.tmp 45 PID 1748 wrote to memory of 700 1748 BB05.tmp 45 PID 1748 wrote to memory of 700 1748 BB05.tmp 45 PID 1748 wrote to memory of 700 1748 BB05.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-06_4dc76e309bc6c39378196f120267d5e3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\BE50.tmp"C:\Users\Admin\AppData\Local\Temp\BE50.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"65⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"68⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"69⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"70⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"72⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"73⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"74⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"75⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"76⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"77⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"78⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"79⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"80⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"81⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"82⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"83⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"84⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"85⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"86⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"87⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"88⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"89⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"90⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"91⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"92⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"93⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"94⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"95⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"96⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"97⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"98⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"99⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"100⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"101⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"102⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"C:\Users\Admin\AppData\Local\Temp\D1DF.tmp"103⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"104⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"105⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\D29B.tmp"C:\Users\Admin\AppData\Local\Temp\D29B.tmp"106⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"107⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\D317.tmp"C:\Users\Admin\AppData\Local\Temp\D317.tmp"108⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"109⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\D394.tmp"C:\Users\Admin\AppData\Local\Temp\D394.tmp"110⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"111⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\D44F.tmp"C:\Users\Admin\AppData\Local\Temp\D44F.tmp"113⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\D48E.tmp"C:\Users\Admin\AppData\Local\Temp\D48E.tmp"114⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"115⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"116⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"117⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"119⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"120⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"121⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-