Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe
-
Size
520KB
-
MD5
e0fee78ce76860f7b3aad6feff2f926d
-
SHA1
93521b78a1f0f3fb83e3fa27af0e87e044b0def1
-
SHA256
58035bb8b52e5215b087851a73834d1d788064e72e0e31ab47333b69d3671bab
-
SHA512
4719b04e45d8312f41b93c874df2ed7e385ba791161633b0dfbf9cb414761ff985d00dbf2ca9fe5f250481628f1fea8f3e444ca4eb74148e9e7028a09e68a37e
-
SSDEEP
12288:gj8fuxR21t5i8ftv/djgiB3jt/0KwurNZ:gj8fuK1GYtHTsQrN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2384 C40.tmp 3064 C9E.tmp 2704 D59.tmp 2816 DC6.tmp 2812 E43.tmp 2460 EDF.tmp 2860 F7B.tmp 2512 1017.tmp 1692 10A4.tmp 2632 1130.tmp 3036 11CC.tmp 3052 1268.tmp 2576 12A6.tmp 2900 1323.tmp 2924 13BF.tmp 2332 142C.tmp 2200 148A.tmp 1652 1507.tmp 2008 1545.tmp 2220 15E1.tmp 1532 166E.tmp 1320 16FA.tmp 1316 1777.tmp 2240 17B5.tmp 2264 17F4.tmp 1992 1832.tmp 1928 1880.tmp 2988 18BE.tmp 1976 18FD.tmp 2284 193B.tmp 780 1989.tmp 1012 19C8.tmp 1496 1A16.tmp 1484 1A54.tmp 1804 1AA2.tmp 1388 1AF0.tmp 960 1B2E.tmp 1148 1B7C.tmp 1052 1BCA.tmp 1772 1C09.tmp 1604 1C47.tmp 1356 1C86.tmp 1248 1CD4.tmp 308 1D12.tmp 768 1D60.tmp 848 1D9E.tmp 1724 1DEC.tmp 1852 1E2B.tmp 720 1E79.tmp 2064 1EB7.tmp 1796 1F05.tmp 888 1F63.tmp 2888 1FB1.tmp 2424 1FFF.tmp 1620 203D.tmp 2472 207C.tmp 2436 20CA.tmp 2692 2108.tmp 3064 2146.tmp 2704 2185.tmp 2748 21C3.tmp 2816 2202.tmp 2752 2250.tmp 1708 228E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2368 2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe 2384 C40.tmp 3064 C9E.tmp 2704 D59.tmp 2816 DC6.tmp 2812 E43.tmp 2460 EDF.tmp 2860 F7B.tmp 2512 1017.tmp 1692 10A4.tmp 2632 1130.tmp 3036 11CC.tmp 3052 1268.tmp 2576 12A6.tmp 2900 1323.tmp 2924 13BF.tmp 2332 142C.tmp 2200 148A.tmp 1652 1507.tmp 2008 1545.tmp 2220 15E1.tmp 1532 166E.tmp 1320 16FA.tmp 1316 1777.tmp 2240 17B5.tmp 2264 17F4.tmp 1992 1832.tmp 1928 1880.tmp 2988 18BE.tmp 1976 18FD.tmp 2284 193B.tmp 780 1989.tmp 1012 19C8.tmp 1496 1A16.tmp 1484 1A54.tmp 1804 1AA2.tmp 1388 1AF0.tmp 960 1B2E.tmp 1148 1B7C.tmp 1052 1BCA.tmp 1772 1C09.tmp 1604 1C47.tmp 1356 1C86.tmp 1248 1CD4.tmp 308 1D12.tmp 768 1D60.tmp 848 1D9E.tmp 1724 1DEC.tmp 1852 1E2B.tmp 720 1E79.tmp 2064 1EB7.tmp 1796 1F05.tmp 888 1F63.tmp 2888 1FB1.tmp 2424 1FFF.tmp 1620 203D.tmp 2472 207C.tmp 2436 20CA.tmp 2692 2108.tmp 3064 2146.tmp 2704 2185.tmp 2748 21C3.tmp 2816 2202.tmp 2752 2250.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2384 2368 2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe 28 PID 2368 wrote to memory of 2384 2368 2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe 28 PID 2368 wrote to memory of 2384 2368 2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe 28 PID 2368 wrote to memory of 2384 2368 2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe 28 PID 2384 wrote to memory of 3064 2384 C40.tmp 29 PID 2384 wrote to memory of 3064 2384 C40.tmp 29 PID 2384 wrote to memory of 3064 2384 C40.tmp 29 PID 2384 wrote to memory of 3064 2384 C40.tmp 29 PID 3064 wrote to memory of 2704 3064 C9E.tmp 30 PID 3064 wrote to memory of 2704 3064 C9E.tmp 30 PID 3064 wrote to memory of 2704 3064 C9E.tmp 30 PID 3064 wrote to memory of 2704 3064 C9E.tmp 30 PID 2704 wrote to memory of 2816 2704 D59.tmp 31 PID 2704 wrote to memory of 2816 2704 D59.tmp 31 PID 2704 wrote to memory of 2816 2704 D59.tmp 31 PID 2704 wrote to memory of 2816 2704 D59.tmp 31 PID 2816 wrote to memory of 2812 2816 DC6.tmp 32 PID 2816 wrote to memory of 2812 2816 DC6.tmp 32 PID 2816 wrote to memory of 2812 2816 DC6.tmp 32 PID 2816 wrote to memory of 2812 2816 DC6.tmp 32 PID 2812 wrote to memory of 2460 2812 E43.tmp 33 PID 2812 wrote to memory of 2460 2812 E43.tmp 33 PID 2812 wrote to memory of 2460 2812 E43.tmp 33 PID 2812 wrote to memory of 2460 2812 E43.tmp 33 PID 2460 wrote to memory of 2860 2460 EDF.tmp 34 PID 2460 wrote to memory of 2860 2460 EDF.tmp 34 PID 2460 wrote to memory of 2860 2460 EDF.tmp 34 PID 2460 wrote to memory of 2860 2460 EDF.tmp 34 PID 2860 wrote to memory of 2512 2860 F7B.tmp 35 PID 2860 wrote to memory of 2512 2860 F7B.tmp 35 PID 2860 wrote to memory of 2512 2860 F7B.tmp 35 PID 2860 wrote to memory of 2512 2860 F7B.tmp 35 PID 2512 wrote to memory of 1692 2512 1017.tmp 36 PID 2512 wrote to memory of 1692 2512 1017.tmp 36 PID 2512 wrote to memory of 1692 2512 1017.tmp 36 PID 2512 wrote to memory of 1692 2512 1017.tmp 36 PID 1692 wrote to memory of 2632 1692 10A4.tmp 37 PID 1692 wrote to memory of 2632 1692 10A4.tmp 37 PID 1692 wrote to memory of 2632 1692 10A4.tmp 37 PID 1692 wrote to memory of 2632 1692 10A4.tmp 37 PID 2632 wrote to memory of 3036 2632 1130.tmp 38 PID 2632 wrote to memory of 3036 2632 1130.tmp 38 PID 2632 wrote to memory of 3036 2632 1130.tmp 38 PID 2632 wrote to memory of 3036 2632 1130.tmp 38 PID 3036 wrote to memory of 3052 3036 11CC.tmp 39 PID 3036 wrote to memory of 3052 3036 11CC.tmp 39 PID 3036 wrote to memory of 3052 3036 11CC.tmp 39 PID 3036 wrote to memory of 3052 3036 11CC.tmp 39 PID 3052 wrote to memory of 2576 3052 1268.tmp 40 PID 3052 wrote to memory of 2576 3052 1268.tmp 40 PID 3052 wrote to memory of 2576 3052 1268.tmp 40 PID 3052 wrote to memory of 2576 3052 1268.tmp 40 PID 2576 wrote to memory of 2900 2576 12A6.tmp 41 PID 2576 wrote to memory of 2900 2576 12A6.tmp 41 PID 2576 wrote to memory of 2900 2576 12A6.tmp 41 PID 2576 wrote to memory of 2900 2576 12A6.tmp 41 PID 2900 wrote to memory of 2924 2900 1323.tmp 42 PID 2900 wrote to memory of 2924 2900 1323.tmp 42 PID 2900 wrote to memory of 2924 2900 1323.tmp 42 PID 2900 wrote to memory of 2924 2900 1323.tmp 42 PID 2924 wrote to memory of 2332 2924 13BF.tmp 43 PID 2924 wrote to memory of 2332 2924 13BF.tmp 43 PID 2924 wrote to memory of 2332 2924 13BF.tmp 43 PID 2924 wrote to memory of 2332 2924 13BF.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-14_e0fee78ce76860f7b3aad6feff2f926d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:720 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"65⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"66⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"68⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"70⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"71⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"72⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"73⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"74⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"75⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"76⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"77⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"78⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"79⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"80⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"81⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"82⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"83⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"84⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"86⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"87⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"88⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"89⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"90⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"91⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"92⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"94⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"95⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"96⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"97⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"98⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"99⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"100⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"101⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"102⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"103⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"104⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"105⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"106⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"107⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"108⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"109⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"110⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"111⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"112⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"113⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"114⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"115⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"116⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"117⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"118⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"119⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"120⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"121⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-