Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe
-
Size
486KB
-
MD5
733d2b3061fe0b82148baabeb7f23358
-
SHA1
1a397a2e20562a5cfd959005262a0f0b95345a59
-
SHA256
a0382d7a90af95f38c96de33c5df8e7f19d54779e98c67d6f49409fc13fc024b
-
SHA512
f2f4ff120b60c140bb7834ff66f8b4bcb74825d4931acea52f0bd835a6912abfb3e7295ac45915966dd1d74ffd09a3882a6917a51ac5d266cb1931656a01b2c1
-
SSDEEP
12288:UU5rCOTeiDSmBicPeOOHMESo8o0D/kPA3/HfmMNZ:UUQOJDUb0D/kUHfhN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2732 657.tmp 1968 696.tmp 2900 712.tmp 1816 770.tmp 2560 7CE.tmp 2676 82B.tmp 2588 898.tmp 2492 8F6.tmp 2480 954.tmp 2504 9B1.tmp 2476 A0F.tmp 2624 A7C.tmp 2988 ADA.tmp 812 B37.tmp 2708 B95.tmp 1988 BF2.tmp 1812 C50.tmp 1784 CBD.tmp 1616 D1B.tmp 1172 D78.tmp 2372 DD6.tmp 1592 E34.tmp 1692 E82.tmp 2076 EC0.tmp 1704 F0E.tmp 2060 F4C.tmp 2316 F8B.tmp 2244 FC9.tmp 2068 1008.tmp 676 1046.tmp 380 1084.tmp 1360 10C3.tmp 588 1101.tmp 1892 114F.tmp 1156 119D.tmp 1076 11DC.tmp 452 121A.tmp 1768 1258.tmp 2920 1297.tmp 680 12D5.tmp 1668 1323.tmp 984 1362.tmp 1904 13B0.tmp 1084 13EE.tmp 1096 142C.tmp 1352 147A.tmp 3044 14C8.tmp 2196 1507.tmp 2152 1555.tmp 1112 1593.tmp 616 15E1.tmp 900 1620.tmp 1100 165E.tmp 2832 169C.tmp 2784 16DB.tmp 2200 1729.tmp 2052 1767.tmp 2040 17A6.tmp 2312 17E4.tmp 2788 1822.tmp 2340 1861.tmp 2596 189F.tmp 2680 18DE.tmp 2696 191C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2888 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 2732 657.tmp 1968 696.tmp 2900 712.tmp 1816 770.tmp 2560 7CE.tmp 2676 82B.tmp 2588 898.tmp 2492 8F6.tmp 2480 954.tmp 2504 9B1.tmp 2476 A0F.tmp 2624 A7C.tmp 2988 ADA.tmp 812 B37.tmp 2708 B95.tmp 1988 BF2.tmp 1812 C50.tmp 1784 CBD.tmp 1616 D1B.tmp 1172 D78.tmp 2372 DD6.tmp 1592 E34.tmp 1692 E82.tmp 2076 EC0.tmp 1704 F0E.tmp 2060 F4C.tmp 2316 F8B.tmp 2244 FC9.tmp 2068 1008.tmp 676 1046.tmp 380 1084.tmp 1360 10C3.tmp 588 1101.tmp 1892 114F.tmp 1156 119D.tmp 1076 11DC.tmp 452 121A.tmp 1768 1258.tmp 2920 1297.tmp 680 12D5.tmp 1668 1323.tmp 984 1362.tmp 1904 13B0.tmp 1084 13EE.tmp 1096 142C.tmp 1352 147A.tmp 3044 14C8.tmp 2196 1507.tmp 2152 1555.tmp 1112 1593.tmp 616 15E1.tmp 900 1620.tmp 1100 165E.tmp 2832 169C.tmp 2784 16DB.tmp 2200 1729.tmp 2052 1767.tmp 2040 17A6.tmp 2312 17E4.tmp 2788 1822.tmp 2340 1861.tmp 2596 189F.tmp 2680 18DE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2732 2888 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 28 PID 2888 wrote to memory of 2732 2888 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 28 PID 2888 wrote to memory of 2732 2888 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 28 PID 2888 wrote to memory of 2732 2888 2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe 28 PID 2732 wrote to memory of 1968 2732 657.tmp 29 PID 2732 wrote to memory of 1968 2732 657.tmp 29 PID 2732 wrote to memory of 1968 2732 657.tmp 29 PID 2732 wrote to memory of 1968 2732 657.tmp 29 PID 1968 wrote to memory of 2900 1968 696.tmp 30 PID 1968 wrote to memory of 2900 1968 696.tmp 30 PID 1968 wrote to memory of 2900 1968 696.tmp 30 PID 1968 wrote to memory of 2900 1968 696.tmp 30 PID 2900 wrote to memory of 1816 2900 712.tmp 31 PID 2900 wrote to memory of 1816 2900 712.tmp 31 PID 2900 wrote to memory of 1816 2900 712.tmp 31 PID 2900 wrote to memory of 1816 2900 712.tmp 31 PID 1816 wrote to memory of 2560 1816 770.tmp 32 PID 1816 wrote to memory of 2560 1816 770.tmp 32 PID 1816 wrote to memory of 2560 1816 770.tmp 32 PID 1816 wrote to memory of 2560 1816 770.tmp 32 PID 2560 wrote to memory of 2676 2560 7CE.tmp 33 PID 2560 wrote to memory of 2676 2560 7CE.tmp 33 PID 2560 wrote to memory of 2676 2560 7CE.tmp 33 PID 2560 wrote to memory of 2676 2560 7CE.tmp 33 PID 2676 wrote to memory of 2588 2676 82B.tmp 34 PID 2676 wrote to memory of 2588 2676 82B.tmp 34 PID 2676 wrote to memory of 2588 2676 82B.tmp 34 PID 2676 wrote to memory of 2588 2676 82B.tmp 34 PID 2588 wrote to memory of 2492 2588 898.tmp 35 PID 2588 wrote to memory of 2492 2588 898.tmp 35 PID 2588 wrote to memory of 2492 2588 898.tmp 35 PID 2588 wrote to memory of 2492 2588 898.tmp 35 PID 2492 wrote to memory of 2480 2492 8F6.tmp 36 PID 2492 wrote to memory of 2480 2492 8F6.tmp 36 PID 2492 wrote to memory of 2480 2492 8F6.tmp 36 PID 2492 wrote to memory of 2480 2492 8F6.tmp 36 PID 2480 wrote to memory of 2504 2480 954.tmp 37 PID 2480 wrote to memory of 2504 2480 954.tmp 37 PID 2480 wrote to memory of 2504 2480 954.tmp 37 PID 2480 wrote to memory of 2504 2480 954.tmp 37 PID 2504 wrote to memory of 2476 2504 9B1.tmp 38 PID 2504 wrote to memory of 2476 2504 9B1.tmp 38 PID 2504 wrote to memory of 2476 2504 9B1.tmp 38 PID 2504 wrote to memory of 2476 2504 9B1.tmp 38 PID 2476 wrote to memory of 2624 2476 A0F.tmp 39 PID 2476 wrote to memory of 2624 2476 A0F.tmp 39 PID 2476 wrote to memory of 2624 2476 A0F.tmp 39 PID 2476 wrote to memory of 2624 2476 A0F.tmp 39 PID 2624 wrote to memory of 2988 2624 A7C.tmp 40 PID 2624 wrote to memory of 2988 2624 A7C.tmp 40 PID 2624 wrote to memory of 2988 2624 A7C.tmp 40 PID 2624 wrote to memory of 2988 2624 A7C.tmp 40 PID 2988 wrote to memory of 812 2988 ADA.tmp 41 PID 2988 wrote to memory of 812 2988 ADA.tmp 41 PID 2988 wrote to memory of 812 2988 ADA.tmp 41 PID 2988 wrote to memory of 812 2988 ADA.tmp 41 PID 812 wrote to memory of 2708 812 B37.tmp 42 PID 812 wrote to memory of 2708 812 B37.tmp 42 PID 812 wrote to memory of 2708 812 B37.tmp 42 PID 812 wrote to memory of 2708 812 B37.tmp 42 PID 2708 wrote to memory of 1988 2708 B95.tmp 43 PID 2708 wrote to memory of 1988 2708 B95.tmp 43 PID 2708 wrote to memory of 1988 2708 B95.tmp 43 PID 2708 wrote to memory of 1988 2708 B95.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_733d2b3061fe0b82148baabeb7f23358_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"67⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"68⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"69⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"72⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"73⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"74⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"75⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"76⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"77⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"78⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"79⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"80⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"81⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"82⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"83⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"84⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"85⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"86⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"87⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"88⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"89⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"90⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"91⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"92⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"93⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"94⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"96⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"97⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"98⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"99⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"100⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"102⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"103⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"104⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"105⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"106⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"107⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"108⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"109⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"110⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"111⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"112⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"113⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"114⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"115⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"116⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"117⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"118⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"119⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"120⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"121⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"122⤵PID:1712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-