Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
-
Size
765KB
-
MD5
8a173f0fc530596d8a0556361ff37bf5
-
SHA1
28a4cb04b533620072ddc69e246486509748b47e
-
SHA256
0fe75470cefb5f803a07e2240f1086bff7e59b133333814b782decd9c9c6b317
-
SHA512
41934806bfde376e5ad1f7c47176363cd5ba705d1c852882fc8ccc5a7c5f6abd9167d9cce75073f67cf98b967efdb75f254b96d98fd105831f717dcde29e0d9f
-
SSDEEP
12288:ZU5rCOTeiDNhDEzuE1c7byKE32qXwHWHCzc3ZF5rn5rLOa54U5w5A:ZUQOJDDDEzXcXyKEmxHCCzc3vh5Oa+Uf
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2992 424E.tmp 2256 4347.tmp 2788 43F3.tmp 2792 4579.tmp 2724 4682.tmp 2868 473D.tmp 2632 4866.tmp 2828 496F.tmp 2624 4A78.tmp 1276 4B33.tmp 1116 4C5C.tmp 2580 4D46.tmp 2920 4E5E.tmp 2960 4F77.tmp 1684 5052.tmp 1804 516A.tmp 1568 5274.tmp 1952 535E.tmp 2484 5476.tmp 1572 5560.tmp 268 564A.tmp 704 5754.tmp 1196 580F.tmp 1548 588C.tmp 872 58F9.tmp 1056 5985.tmp 1188 59D3.tmp 2352 5A50.tmp 3028 5AAE.tmp 2296 5B2A.tmp 2212 5BA7.tmp 1728 5C34.tmp 1820 5C91.tmp 1732 5CFE.tmp 1112 5D8B.tmp 2340 5DF8.tmp 2356 5E65.tmp 2196 5F01.tmp 2260 5F6E.tmp 1780 5FDC.tmp 828 6068.tmp 1600 60C6.tmp 1040 6142.tmp 996 61CF.tmp 904 622C.tmp 1692 629A.tmp 2188 6326.tmp 1336 6384.tmp 2176 6401.tmp 2312 645E.tmp 2060 64CB.tmp 1924 6539.tmp 1724 6596.tmp 2428 6603.tmp 1760 670D.tmp 2160 67F7.tmp 2280 6883.tmp 2740 68F0.tmp 2804 695D.tmp 3016 69BB.tmp 2072 6A38.tmp 2744 6AA5.tmp 2752 6B22.tmp 2620 6B8F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2228 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 2992 424E.tmp 2256 4347.tmp 2788 43F3.tmp 2792 4579.tmp 2724 4682.tmp 2868 473D.tmp 2632 4866.tmp 2828 496F.tmp 2624 4A78.tmp 1276 4B33.tmp 1116 4C5C.tmp 2580 4D46.tmp 2920 4E5E.tmp 2960 4F77.tmp 1684 5052.tmp 1804 516A.tmp 1568 5274.tmp 1952 535E.tmp 2484 5476.tmp 1572 5560.tmp 268 564A.tmp 704 5754.tmp 1196 580F.tmp 1548 588C.tmp 872 58F9.tmp 1056 5985.tmp 1188 59D3.tmp 2352 5A50.tmp 3028 5AAE.tmp 2296 5B2A.tmp 2212 5BA7.tmp 1728 5C34.tmp 1820 5C91.tmp 1732 5CFE.tmp 1112 5D8B.tmp 2340 5DF8.tmp 2356 5E65.tmp 2196 5F01.tmp 2260 5F6E.tmp 1780 5FDC.tmp 828 6068.tmp 1600 60C6.tmp 1040 6142.tmp 996 61CF.tmp 904 622C.tmp 1692 629A.tmp 2188 6326.tmp 1336 6384.tmp 2176 6401.tmp 2312 645E.tmp 2060 64CB.tmp 1924 6539.tmp 1724 6596.tmp 2428 6603.tmp 1760 670D.tmp 2160 67F7.tmp 2280 6883.tmp 2740 68F0.tmp 2804 695D.tmp 3016 69BB.tmp 2072 6A38.tmp 2744 6AA5.tmp 2752 6B22.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2992 2228 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 28 PID 2228 wrote to memory of 2992 2228 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 28 PID 2228 wrote to memory of 2992 2228 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 28 PID 2228 wrote to memory of 2992 2228 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 28 PID 2992 wrote to memory of 2256 2992 424E.tmp 29 PID 2992 wrote to memory of 2256 2992 424E.tmp 29 PID 2992 wrote to memory of 2256 2992 424E.tmp 29 PID 2992 wrote to memory of 2256 2992 424E.tmp 29 PID 2256 wrote to memory of 2788 2256 4347.tmp 30 PID 2256 wrote to memory of 2788 2256 4347.tmp 30 PID 2256 wrote to memory of 2788 2256 4347.tmp 30 PID 2256 wrote to memory of 2788 2256 4347.tmp 30 PID 2788 wrote to memory of 2792 2788 43F3.tmp 31 PID 2788 wrote to memory of 2792 2788 43F3.tmp 31 PID 2788 wrote to memory of 2792 2788 43F3.tmp 31 PID 2788 wrote to memory of 2792 2788 43F3.tmp 31 PID 2792 wrote to memory of 2724 2792 4579.tmp 32 PID 2792 wrote to memory of 2724 2792 4579.tmp 32 PID 2792 wrote to memory of 2724 2792 4579.tmp 32 PID 2792 wrote to memory of 2724 2792 4579.tmp 32 PID 2724 wrote to memory of 2868 2724 4682.tmp 33 PID 2724 wrote to memory of 2868 2724 4682.tmp 33 PID 2724 wrote to memory of 2868 2724 4682.tmp 33 PID 2724 wrote to memory of 2868 2724 4682.tmp 33 PID 2868 wrote to memory of 2632 2868 473D.tmp 34 PID 2868 wrote to memory of 2632 2868 473D.tmp 34 PID 2868 wrote to memory of 2632 2868 473D.tmp 34 PID 2868 wrote to memory of 2632 2868 473D.tmp 34 PID 2632 wrote to memory of 2828 2632 4866.tmp 35 PID 2632 wrote to memory of 2828 2632 4866.tmp 35 PID 2632 wrote to memory of 2828 2632 4866.tmp 35 PID 2632 wrote to memory of 2828 2632 4866.tmp 35 PID 2828 wrote to memory of 2624 2828 496F.tmp 36 PID 2828 wrote to memory of 2624 2828 496F.tmp 36 PID 2828 wrote to memory of 2624 2828 496F.tmp 36 PID 2828 wrote to memory of 2624 2828 496F.tmp 36 PID 2624 wrote to memory of 1276 2624 4A78.tmp 37 PID 2624 wrote to memory of 1276 2624 4A78.tmp 37 PID 2624 wrote to memory of 1276 2624 4A78.tmp 37 PID 2624 wrote to memory of 1276 2624 4A78.tmp 37 PID 1276 wrote to memory of 1116 1276 4B33.tmp 38 PID 1276 wrote to memory of 1116 1276 4B33.tmp 38 PID 1276 wrote to memory of 1116 1276 4B33.tmp 38 PID 1276 wrote to memory of 1116 1276 4B33.tmp 38 PID 1116 wrote to memory of 2580 1116 4C5C.tmp 39 PID 1116 wrote to memory of 2580 1116 4C5C.tmp 39 PID 1116 wrote to memory of 2580 1116 4C5C.tmp 39 PID 1116 wrote to memory of 2580 1116 4C5C.tmp 39 PID 2580 wrote to memory of 2920 2580 4D46.tmp 40 PID 2580 wrote to memory of 2920 2580 4D46.tmp 40 PID 2580 wrote to memory of 2920 2580 4D46.tmp 40 PID 2580 wrote to memory of 2920 2580 4D46.tmp 40 PID 2920 wrote to memory of 2960 2920 4E5E.tmp 41 PID 2920 wrote to memory of 2960 2920 4E5E.tmp 41 PID 2920 wrote to memory of 2960 2920 4E5E.tmp 41 PID 2920 wrote to memory of 2960 2920 4E5E.tmp 41 PID 2960 wrote to memory of 1684 2960 4F77.tmp 42 PID 2960 wrote to memory of 1684 2960 4F77.tmp 42 PID 2960 wrote to memory of 1684 2960 4F77.tmp 42 PID 2960 wrote to memory of 1684 2960 4F77.tmp 42 PID 1684 wrote to memory of 1804 1684 5052.tmp 43 PID 1684 wrote to memory of 1804 1684 5052.tmp 43 PID 1684 wrote to memory of 1804 1684 5052.tmp 43 PID 1684 wrote to memory of 1804 1684 5052.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"C:\Users\Admin\AppData\Local\Temp\5DF8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\60C6.tmp"C:\Users\Admin\AppData\Local\Temp\60C6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\622C.tmp"C:\Users\Admin\AppData\Local\Temp\622C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"66⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"67⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"69⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"71⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"72⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"73⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"76⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"77⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"78⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"79⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"80⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"81⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"82⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"83⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"84⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"85⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"86⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"87⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"88⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"89⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"90⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"91⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"92⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"93⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"94⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"96⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"97⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"98⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"99⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"100⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"101⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"102⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"103⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"104⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"105⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"106⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"107⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"108⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"109⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"110⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"111⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"112⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"113⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"114⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"115⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"116⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"117⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"118⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"119⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"120⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"121⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"122⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-