Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe
-
Size
486KB
-
MD5
1c4dacf55c2ad0797a6097e505a4c2a6
-
SHA1
c4e4c09a36731e57eefd4311c5500f0c322ff538
-
SHA256
ba04f0f0ee438dd8076218851b9b174c81f2c9c1d85b018eda80b90d3a0d7c18
-
SHA512
b8981c9ff2fecec826122a044f4a7a07c971e2aa2a25696d466c5826f2733f3eedc91413e33e7065c8de39f339999730360273ee70a811f7f205b8f559972221
-
SSDEEP
12288:/U5rCOTeiDmRIuvqjsvDVZFMqs3p1TGSNZ:/UQOJD19cVZFxs3p/N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1256 D59.tmp 2756 DB7.tmp 2572 E05.tmp 2664 E62.tmp 2660 ED0.tmp 2736 F2D.tmp 2500 F9A.tmp 2488 1008.tmp 2464 1065.tmp 2536 10E2.tmp 2744 1140.tmp 2512 11AD.tmp 2792 120A.tmp 2840 1278.tmp 2960 12D5.tmp 332 1333.tmp 1748 1390.tmp 1676 13FE.tmp 1600 145B.tmp 1568 14A9.tmp 2772 1507.tmp 1444 1564.tmp 872 15C2.tmp 2312 1610.tmp 2012 165E.tmp 2304 169C.tmp 2444 16EA.tmp 3028 1729.tmp 2024 1767.tmp 2288 17B5.tmp 268 17F4.tmp 1172 1832.tmp 1516 1870.tmp 2032 18BE.tmp 1820 18FD.tmp 1088 193B.tmp 648 197A.tmp 1176 19B8.tmp 1140 19F6.tmp 2244 1A35.tmp 1400 1A73.tmp 1576 1AC1.tmp 1360 1B00.tmp 1900 1B3E.tmp 1836 1B7C.tmp 1332 1BBB.tmp 568 1BF9.tmp 3032 1C38.tmp 1996 1C76.tmp 528 1CC4.tmp 1312 1D02.tmp 2076 1D41.tmp 892 1D7F.tmp 1316 1DCD.tmp 1132 1E1B.tmp 2420 1EA8.tmp 2864 1EF6.tmp 2752 1F34.tmp 2568 1F72.tmp 2608 1FB1.tmp 2668 1FEF.tmp 2728 202E.tmp 2616 206C.tmp 2644 20CA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2388 2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe 1256 D59.tmp 2756 DB7.tmp 2572 E05.tmp 2664 E62.tmp 2660 ED0.tmp 2736 F2D.tmp 2500 F9A.tmp 2488 1008.tmp 2464 1065.tmp 2536 10E2.tmp 2744 1140.tmp 2512 11AD.tmp 2792 120A.tmp 2840 1278.tmp 2960 12D5.tmp 332 1333.tmp 1748 1390.tmp 1676 13FE.tmp 1600 145B.tmp 1568 14A9.tmp 2772 1507.tmp 1444 1564.tmp 872 15C2.tmp 2312 1610.tmp 2012 165E.tmp 2304 169C.tmp 2444 16EA.tmp 3028 1729.tmp 2024 1767.tmp 2288 17B5.tmp 268 17F4.tmp 1172 1832.tmp 1516 1870.tmp 2032 18BE.tmp 1820 18FD.tmp 1088 193B.tmp 648 197A.tmp 1176 19B8.tmp 1140 19F6.tmp 2244 1A35.tmp 1400 1A73.tmp 1576 1AC1.tmp 1360 1B00.tmp 1900 1B3E.tmp 1836 1B7C.tmp 1332 1BBB.tmp 568 1BF9.tmp 3032 1C38.tmp 1996 1C76.tmp 528 1CC4.tmp 1312 1D02.tmp 2076 1D41.tmp 892 1D7F.tmp 1316 1DCD.tmp 1620 1E69.tmp 2420 1EA8.tmp 2864 1EF6.tmp 2752 1F34.tmp 2568 1F72.tmp 2608 1FB1.tmp 2668 1FEF.tmp 2728 202E.tmp 2616 206C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1256 2388 2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe 28 PID 2388 wrote to memory of 1256 2388 2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe 28 PID 2388 wrote to memory of 1256 2388 2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe 28 PID 2388 wrote to memory of 1256 2388 2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe 28 PID 1256 wrote to memory of 2756 1256 D59.tmp 29 PID 1256 wrote to memory of 2756 1256 D59.tmp 29 PID 1256 wrote to memory of 2756 1256 D59.tmp 29 PID 1256 wrote to memory of 2756 1256 D59.tmp 29 PID 2756 wrote to memory of 2572 2756 DB7.tmp 30 PID 2756 wrote to memory of 2572 2756 DB7.tmp 30 PID 2756 wrote to memory of 2572 2756 DB7.tmp 30 PID 2756 wrote to memory of 2572 2756 DB7.tmp 30 PID 2572 wrote to memory of 2664 2572 E05.tmp 31 PID 2572 wrote to memory of 2664 2572 E05.tmp 31 PID 2572 wrote to memory of 2664 2572 E05.tmp 31 PID 2572 wrote to memory of 2664 2572 E05.tmp 31 PID 2664 wrote to memory of 2660 2664 E62.tmp 32 PID 2664 wrote to memory of 2660 2664 E62.tmp 32 PID 2664 wrote to memory of 2660 2664 E62.tmp 32 PID 2664 wrote to memory of 2660 2664 E62.tmp 32 PID 2660 wrote to memory of 2736 2660 ED0.tmp 33 PID 2660 wrote to memory of 2736 2660 ED0.tmp 33 PID 2660 wrote to memory of 2736 2660 ED0.tmp 33 PID 2660 wrote to memory of 2736 2660 ED0.tmp 33 PID 2736 wrote to memory of 2500 2736 F2D.tmp 34 PID 2736 wrote to memory of 2500 2736 F2D.tmp 34 PID 2736 wrote to memory of 2500 2736 F2D.tmp 34 PID 2736 wrote to memory of 2500 2736 F2D.tmp 34 PID 2500 wrote to memory of 2488 2500 F9A.tmp 35 PID 2500 wrote to memory of 2488 2500 F9A.tmp 35 PID 2500 wrote to memory of 2488 2500 F9A.tmp 35 PID 2500 wrote to memory of 2488 2500 F9A.tmp 35 PID 2488 wrote to memory of 2464 2488 1008.tmp 36 PID 2488 wrote to memory of 2464 2488 1008.tmp 36 PID 2488 wrote to memory of 2464 2488 1008.tmp 36 PID 2488 wrote to memory of 2464 2488 1008.tmp 36 PID 2464 wrote to memory of 2536 2464 1065.tmp 37 PID 2464 wrote to memory of 2536 2464 1065.tmp 37 PID 2464 wrote to memory of 2536 2464 1065.tmp 37 PID 2464 wrote to memory of 2536 2464 1065.tmp 37 PID 2536 wrote to memory of 2744 2536 10E2.tmp 38 PID 2536 wrote to memory of 2744 2536 10E2.tmp 38 PID 2536 wrote to memory of 2744 2536 10E2.tmp 38 PID 2536 wrote to memory of 2744 2536 10E2.tmp 38 PID 2744 wrote to memory of 2512 2744 1140.tmp 39 PID 2744 wrote to memory of 2512 2744 1140.tmp 39 PID 2744 wrote to memory of 2512 2744 1140.tmp 39 PID 2744 wrote to memory of 2512 2744 1140.tmp 39 PID 2512 wrote to memory of 2792 2512 11AD.tmp 40 PID 2512 wrote to memory of 2792 2512 11AD.tmp 40 PID 2512 wrote to memory of 2792 2512 11AD.tmp 40 PID 2512 wrote to memory of 2792 2512 11AD.tmp 40 PID 2792 wrote to memory of 2840 2792 120A.tmp 41 PID 2792 wrote to memory of 2840 2792 120A.tmp 41 PID 2792 wrote to memory of 2840 2792 120A.tmp 41 PID 2792 wrote to memory of 2840 2792 120A.tmp 41 PID 2840 wrote to memory of 2960 2840 1278.tmp 42 PID 2840 wrote to memory of 2960 2840 1278.tmp 42 PID 2840 wrote to memory of 2960 2840 1278.tmp 42 PID 2840 wrote to memory of 2960 2840 1278.tmp 42 PID 2960 wrote to memory of 332 2960 12D5.tmp 43 PID 2960 wrote to memory of 332 2960 12D5.tmp 43 PID 2960 wrote to memory of 332 2960 12D5.tmp 43 PID 2960 wrote to memory of 332 2960 12D5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_1c4dacf55c2ad0797a6097e505a4c2a6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"56⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"57⤵
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"66⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"67⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"69⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"70⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"71⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"72⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"74⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"75⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"76⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"77⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"78⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"79⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"80⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"81⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"82⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"84⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"86⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"87⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"88⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"89⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"90⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"91⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"92⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"93⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"94⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"95⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"96⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"97⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"98⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"100⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"101⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"102⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"103⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"104⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"105⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"106⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"107⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"108⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"109⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"110⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"111⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"112⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"113⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"114⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"115⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"116⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"117⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"118⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"119⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"120⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"121⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"122⤵PID:1408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-