Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe
-
Size
487KB
-
MD5
df9277c467166b0bfa733c34a7a83461
-
SHA1
8f2c0d3c09ccc9d34691d04f760cc6373afa9905
-
SHA256
71c07d93e52d5fa83b1117af54c8e6add87f2d650123bc4b1e31dea361d65a7e
-
SHA512
b2ed9bd3585ad5a80b7b0e55bf07065f78d352e5fc22efcc16616fe4f73dc495e3e4fc590dda06eaaf92169ab788e02b279b4994f0d0cb9f58631f419d42c7d1
-
SSDEEP
12288:yU5rCOTeiN6BW67Act0eSLMWT1kmURBugbZ:yUQOJN6BlZt0eSLZbxgb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2916 45E6.tmp 2660 46B1.tmp 2672 47BA.tmp 2800 48C3.tmp 2416 499E.tmp 2820 4A88.tmp 2824 4B43.tmp 2704 4C0E.tmp 1080 4CF8.tmp 2612 4DD2.tmp 2148 4EAC.tmp 2552 4F96.tmp 2880 5080.tmp 2988 515B.tmp 268 5264.tmp 1712 532F.tmp 1988 53EA.tmp 1880 54B5.tmp 1144 559F.tmp 2244 56A8.tmp 772 580F.tmp 612 58DA.tmp 1108 5956.tmp 1688 59C4.tmp 1556 5A40.tmp 1636 5ABD.tmp 628 5B2A.tmp 1940 5B98.tmp 1308 5C05.tmp 2196 5C72.tmp 2324 5CDF.tmp 2036 5D4C.tmp 2032 5DC9.tmp 2260 5E46.tmp 2464 5EB3.tmp 1968 5F30.tmp 2212 5FAD.tmp 1052 6039.tmp 1916 60A6.tmp 872 6123.tmp 1548 6190.tmp 1272 620D.tmp 2972 629A.tmp 1824 6307.tmp 928 6384.tmp 608 6401.tmp 800 644F.tmp 2124 64CB.tmp 2968 6548.tmp 2228 65D5.tmp 2524 6651.tmp 2068 66CE.tmp 2508 674B.tmp 1620 67B8.tmp 2208 6825.tmp 2752 6893.tmp 2340 690F.tmp 2772 697D.tmp 2796 69EA.tmp 2672 6A57.tmp 2828 6AD4.tmp 2328 6B60.tmp 2728 6C89.tmp 2904 6D15.tmp -
Loads dropped DLL 64 IoCs
pid Process 1364 2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe 2916 45E6.tmp 2660 46B1.tmp 2672 47BA.tmp 2800 48C3.tmp 2416 499E.tmp 2820 4A88.tmp 2824 4B43.tmp 2704 4C0E.tmp 1080 4CF8.tmp 2612 4DD2.tmp 2148 4EAC.tmp 2552 4F96.tmp 2880 5080.tmp 2988 515B.tmp 268 5264.tmp 1712 532F.tmp 1988 53EA.tmp 1880 54B5.tmp 1144 559F.tmp 2244 56A8.tmp 772 580F.tmp 612 58DA.tmp 1108 5956.tmp 1688 59C4.tmp 1556 5A40.tmp 1636 5ABD.tmp 628 5B2A.tmp 1940 5B98.tmp 1308 5C05.tmp 2196 5C72.tmp 2324 5CDF.tmp 2036 5D4C.tmp 2032 5DC9.tmp 2260 5E46.tmp 2464 5EB3.tmp 1968 5F30.tmp 2212 5FAD.tmp 1052 6039.tmp 1916 60A6.tmp 872 6123.tmp 1548 6190.tmp 1272 620D.tmp 2972 629A.tmp 1824 6307.tmp 928 6384.tmp 608 6401.tmp 800 644F.tmp 2124 64CB.tmp 2968 6548.tmp 2228 65D5.tmp 2524 6651.tmp 2068 66CE.tmp 2508 674B.tmp 1620 67B8.tmp 2208 6825.tmp 2752 6893.tmp 2340 690F.tmp 2772 697D.tmp 2796 69EA.tmp 2672 6A57.tmp 2828 6AD4.tmp 2328 6B60.tmp 2728 6C89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2916 1364 2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe 28 PID 1364 wrote to memory of 2916 1364 2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe 28 PID 1364 wrote to memory of 2916 1364 2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe 28 PID 1364 wrote to memory of 2916 1364 2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe 28 PID 2916 wrote to memory of 2660 2916 45E6.tmp 29 PID 2916 wrote to memory of 2660 2916 45E6.tmp 29 PID 2916 wrote to memory of 2660 2916 45E6.tmp 29 PID 2916 wrote to memory of 2660 2916 45E6.tmp 29 PID 2660 wrote to memory of 2672 2660 46B1.tmp 30 PID 2660 wrote to memory of 2672 2660 46B1.tmp 30 PID 2660 wrote to memory of 2672 2660 46B1.tmp 30 PID 2660 wrote to memory of 2672 2660 46B1.tmp 30 PID 2672 wrote to memory of 2800 2672 47BA.tmp 31 PID 2672 wrote to memory of 2800 2672 47BA.tmp 31 PID 2672 wrote to memory of 2800 2672 47BA.tmp 31 PID 2672 wrote to memory of 2800 2672 47BA.tmp 31 PID 2800 wrote to memory of 2416 2800 48C3.tmp 32 PID 2800 wrote to memory of 2416 2800 48C3.tmp 32 PID 2800 wrote to memory of 2416 2800 48C3.tmp 32 PID 2800 wrote to memory of 2416 2800 48C3.tmp 32 PID 2416 wrote to memory of 2820 2416 499E.tmp 33 PID 2416 wrote to memory of 2820 2416 499E.tmp 33 PID 2416 wrote to memory of 2820 2416 499E.tmp 33 PID 2416 wrote to memory of 2820 2416 499E.tmp 33 PID 2820 wrote to memory of 2824 2820 4A88.tmp 34 PID 2820 wrote to memory of 2824 2820 4A88.tmp 34 PID 2820 wrote to memory of 2824 2820 4A88.tmp 34 PID 2820 wrote to memory of 2824 2820 4A88.tmp 34 PID 2824 wrote to memory of 2704 2824 4B43.tmp 35 PID 2824 wrote to memory of 2704 2824 4B43.tmp 35 PID 2824 wrote to memory of 2704 2824 4B43.tmp 35 PID 2824 wrote to memory of 2704 2824 4B43.tmp 35 PID 2704 wrote to memory of 1080 2704 4C0E.tmp 36 PID 2704 wrote to memory of 1080 2704 4C0E.tmp 36 PID 2704 wrote to memory of 1080 2704 4C0E.tmp 36 PID 2704 wrote to memory of 1080 2704 4C0E.tmp 36 PID 1080 wrote to memory of 2612 1080 4CF8.tmp 37 PID 1080 wrote to memory of 2612 1080 4CF8.tmp 37 PID 1080 wrote to memory of 2612 1080 4CF8.tmp 37 PID 1080 wrote to memory of 2612 1080 4CF8.tmp 37 PID 2612 wrote to memory of 2148 2612 4DD2.tmp 38 PID 2612 wrote to memory of 2148 2612 4DD2.tmp 38 PID 2612 wrote to memory of 2148 2612 4DD2.tmp 38 PID 2612 wrote to memory of 2148 2612 4DD2.tmp 38 PID 2148 wrote to memory of 2552 2148 4EAC.tmp 39 PID 2148 wrote to memory of 2552 2148 4EAC.tmp 39 PID 2148 wrote to memory of 2552 2148 4EAC.tmp 39 PID 2148 wrote to memory of 2552 2148 4EAC.tmp 39 PID 2552 wrote to memory of 2880 2552 4F96.tmp 40 PID 2552 wrote to memory of 2880 2552 4F96.tmp 40 PID 2552 wrote to memory of 2880 2552 4F96.tmp 40 PID 2552 wrote to memory of 2880 2552 4F96.tmp 40 PID 2880 wrote to memory of 2988 2880 5080.tmp 41 PID 2880 wrote to memory of 2988 2880 5080.tmp 41 PID 2880 wrote to memory of 2988 2880 5080.tmp 41 PID 2880 wrote to memory of 2988 2880 5080.tmp 41 PID 2988 wrote to memory of 268 2988 515B.tmp 42 PID 2988 wrote to memory of 268 2988 515B.tmp 42 PID 2988 wrote to memory of 268 2988 515B.tmp 42 PID 2988 wrote to memory of 268 2988 515B.tmp 42 PID 268 wrote to memory of 1712 268 5264.tmp 43 PID 268 wrote to memory of 1712 268 5264.tmp 43 PID 268 wrote to memory of 1712 268 5264.tmp 43 PID 268 wrote to memory of 1712 268 5264.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_df9277c467166b0bfa733c34a7a83461_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\59C4.tmp"C:\Users\Admin\AppData\Local\Temp\59C4.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"65⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"66⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"67⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"68⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"69⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"70⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"71⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"72⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"73⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"74⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"75⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"76⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"77⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"78⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"79⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"81⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"82⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"83⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"84⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"85⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"86⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"87⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"88⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"89⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"90⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"91⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"92⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"94⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"95⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"96⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"97⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"98⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"99⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"100⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"101⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"102⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"103⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"104⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"105⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"106⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"107⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"108⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"109⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"110⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"111⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"112⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"113⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"114⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"115⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"116⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"117⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"118⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"120⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"121⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-