Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 05:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe
-
Size
541KB
-
MD5
f8a2bb06e4dca774b4a3c98eb5ac601e
-
SHA1
e6a69a730351b64ad8b5e3c551c76bf9f4911e8d
-
SHA256
63d784898396337bcd333834ebf9e006efb594cc6b5d6c5a44f12ab0920d9cad
-
SHA512
cbd6a5199854adfe9ec4801d7ac2484344270ad35ad0feccf05b66fabb2bcb5f87550f5cda304e1007c4fa7e3e63fe8c6d56dcbd53b4f848e0449c4d04f81f91
-
SSDEEP
12288:UU5rCOTeifnsmSJcb3NMUPn899fkpI7C2NfHrZa73ctO:UUQOJfnsmSyxMknWkpI7F/rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2360 47AA.tmp 2500 4818.tmp 2944 48E2.tmp 2628 49EC.tmp 2816 4AB6.tmp 2056 4B62.tmp 1948 4BEE.tmp 2432 4C6B.tmp 1780 4CB9.tmp 2484 4D84.tmp 2680 4E01.tmp 2392 4E6E.tmp 324 4F29.tmp 588 4FA6.tmp 476 5052.tmp 2068 510D.tmp 1832 518A.tmp 1792 5254.tmp 1988 52F0.tmp 1040 535E.tmp 280 5476.tmp 568 5503.tmp 2664 55ED.tmp 2740 565A.tmp 2072 56B8.tmp 1304 5734.tmp 664 57A2.tmp 2380 580F.tmp 2284 587C.tmp 2104 58F9.tmp 1128 5A02.tmp 2956 5A7F.tmp 1588 5AFC.tmp 2820 5B69.tmp 3024 5BC6.tmp 1088 5CB0.tmp 2160 5D1E.tmp 2300 5DAA.tmp 2244 5E46.tmp 1344 5F01.tmp 1900 5FCC.tmp 952 602A.tmp 3060 6087.tmp 2040 60F4.tmp 2028 6162.tmp 888 61DE.tmp 1632 625B.tmp 1744 62D8.tmp 2168 6345.tmp 1812 63D2.tmp 2488 642F.tmp 1496 64AC.tmp 880 6519.tmp 1724 6596.tmp 2836 6613.tmp 1596 6671.tmp 1700 66CE.tmp 2356 676A.tmp 2552 67C8.tmp 2500 6825.tmp 2640 68B2.tmp 2644 691F.tmp 2628 698C.tmp 2808 6A09.tmp -
Loads dropped DLL 64 IoCs
pid Process 1364 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 2360 47AA.tmp 2500 4818.tmp 2944 48E2.tmp 2628 49EC.tmp 2816 4AB6.tmp 2056 4B62.tmp 1948 4BEE.tmp 2432 4C6B.tmp 1780 4CB9.tmp 2484 4D84.tmp 2680 4E01.tmp 2392 4E6E.tmp 324 4F29.tmp 588 4FA6.tmp 476 5052.tmp 2068 510D.tmp 1832 518A.tmp 1792 5254.tmp 1988 52F0.tmp 1040 535E.tmp 280 5476.tmp 568 5503.tmp 2664 55ED.tmp 2740 565A.tmp 2072 56B8.tmp 1304 5734.tmp 664 57A2.tmp 2380 580F.tmp 2284 587C.tmp 2104 58F9.tmp 1128 5A02.tmp 2956 5A7F.tmp 1588 5AFC.tmp 2820 5B69.tmp 3024 5BC6.tmp 1088 5CB0.tmp 2160 5D1E.tmp 2300 5DAA.tmp 2244 5E46.tmp 1344 5F01.tmp 1900 5FCC.tmp 952 602A.tmp 3060 6087.tmp 2040 60F4.tmp 2028 6162.tmp 888 61DE.tmp 1632 625B.tmp 1744 62D8.tmp 2168 6345.tmp 1812 63D2.tmp 2488 642F.tmp 1496 64AC.tmp 880 6519.tmp 1724 6596.tmp 2836 6613.tmp 1596 6671.tmp 1700 66CE.tmp 2356 676A.tmp 2552 67C8.tmp 2500 6825.tmp 2640 68B2.tmp 2644 691F.tmp 2628 698C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2360 1364 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 28 PID 1364 wrote to memory of 2360 1364 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 28 PID 1364 wrote to memory of 2360 1364 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 28 PID 1364 wrote to memory of 2360 1364 2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe 28 PID 2360 wrote to memory of 2500 2360 47AA.tmp 29 PID 2360 wrote to memory of 2500 2360 47AA.tmp 29 PID 2360 wrote to memory of 2500 2360 47AA.tmp 29 PID 2360 wrote to memory of 2500 2360 47AA.tmp 29 PID 2500 wrote to memory of 2944 2500 4818.tmp 30 PID 2500 wrote to memory of 2944 2500 4818.tmp 30 PID 2500 wrote to memory of 2944 2500 4818.tmp 30 PID 2500 wrote to memory of 2944 2500 4818.tmp 30 PID 2944 wrote to memory of 2628 2944 48E2.tmp 31 PID 2944 wrote to memory of 2628 2944 48E2.tmp 31 PID 2944 wrote to memory of 2628 2944 48E2.tmp 31 PID 2944 wrote to memory of 2628 2944 48E2.tmp 31 PID 2628 wrote to memory of 2816 2628 49EC.tmp 32 PID 2628 wrote to memory of 2816 2628 49EC.tmp 32 PID 2628 wrote to memory of 2816 2628 49EC.tmp 32 PID 2628 wrote to memory of 2816 2628 49EC.tmp 32 PID 2816 wrote to memory of 2056 2816 4AB6.tmp 33 PID 2816 wrote to memory of 2056 2816 4AB6.tmp 33 PID 2816 wrote to memory of 2056 2816 4AB6.tmp 33 PID 2816 wrote to memory of 2056 2816 4AB6.tmp 33 PID 2056 wrote to memory of 1948 2056 4B62.tmp 34 PID 2056 wrote to memory of 1948 2056 4B62.tmp 34 PID 2056 wrote to memory of 1948 2056 4B62.tmp 34 PID 2056 wrote to memory of 1948 2056 4B62.tmp 34 PID 1948 wrote to memory of 2432 1948 4BEE.tmp 48 PID 1948 wrote to memory of 2432 1948 4BEE.tmp 48 PID 1948 wrote to memory of 2432 1948 4BEE.tmp 48 PID 1948 wrote to memory of 2432 1948 4BEE.tmp 48 PID 2432 wrote to memory of 1780 2432 4C6B.tmp 39 PID 2432 wrote to memory of 1780 2432 4C6B.tmp 39 PID 2432 wrote to memory of 1780 2432 4C6B.tmp 39 PID 2432 wrote to memory of 1780 2432 4C6B.tmp 39 PID 1780 wrote to memory of 2484 1780 4CB9.tmp 38 PID 1780 wrote to memory of 2484 1780 4CB9.tmp 38 PID 1780 wrote to memory of 2484 1780 4CB9.tmp 38 PID 1780 wrote to memory of 2484 1780 4CB9.tmp 38 PID 2484 wrote to memory of 2680 2484 4D84.tmp 36 PID 2484 wrote to memory of 2680 2484 4D84.tmp 36 PID 2484 wrote to memory of 2680 2484 4D84.tmp 36 PID 2484 wrote to memory of 2680 2484 4D84.tmp 36 PID 2680 wrote to memory of 2392 2680 4E01.tmp 35 PID 2680 wrote to memory of 2392 2680 4E01.tmp 35 PID 2680 wrote to memory of 2392 2680 4E01.tmp 35 PID 2680 wrote to memory of 2392 2680 4E01.tmp 35 PID 2392 wrote to memory of 324 2392 4E6E.tmp 37 PID 2392 wrote to memory of 324 2392 4E6E.tmp 37 PID 2392 wrote to memory of 324 2392 4E6E.tmp 37 PID 2392 wrote to memory of 324 2392 4E6E.tmp 37 PID 324 wrote to memory of 588 324 4F29.tmp 43 PID 324 wrote to memory of 588 324 4F29.tmp 43 PID 324 wrote to memory of 588 324 4F29.tmp 43 PID 324 wrote to memory of 588 324 4F29.tmp 43 PID 588 wrote to memory of 476 588 4FA6.tmp 40 PID 588 wrote to memory of 476 588 4FA6.tmp 40 PID 588 wrote to memory of 476 588 4FA6.tmp 40 PID 588 wrote to memory of 476 588 4FA6.tmp 40 PID 476 wrote to memory of 2068 476 5052.tmp 41 PID 476 wrote to memory of 2068 476 5052.tmp 41 PID 476 wrote to memory of 2068 476 5052.tmp 41 PID 476 wrote to memory of 2068 476 5052.tmp 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_f8a2bb06e4dca774b4a3c98eb5ac601e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588
-
-
-
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484
-
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5254.tmp"C:\Users\Admin\AppData\Local\Temp\5254.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\5503.tmp"C:\Users\Admin\AppData\Local\Temp\5503.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\587C.tmp"C:\Users\Admin\AppData\Local\Temp\587C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\61DE.tmp"C:\Users\Admin\AppData\Local\Temp\61DE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\63D2.tmp"C:\Users\Admin\AppData\Local\Temp\63D2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"46⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"47⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"48⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"49⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"50⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"51⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"52⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"53⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"54⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"55⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"56⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"57⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"58⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"59⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"60⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"61⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"62⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"63⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"64⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"65⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"66⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"67⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"68⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"69⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"70⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"71⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"72⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"73⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"74⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"75⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"76⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"77⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\78B9.tmp"C:\Users\Admin\AppData\Local\Temp\78B9.tmp"78⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7926.tmp"C:\Users\Admin\AppData\Local\Temp\7926.tmp"79⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"80⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"81⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"82⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"83⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"84⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"85⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"86⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"87⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"88⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"89⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"90⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"91⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"92⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"93⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"94⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"95⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"96⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"97⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"98⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"99⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"100⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"101⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"102⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"103⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"104⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"105⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"106⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"107⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"108⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"109⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"110⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"111⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"112⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"113⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"114⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"115⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"116⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"117⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"118⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"119⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"120⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"121⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"122⤵PID:2680
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-