Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 04:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe
-
Size
488KB
-
MD5
969f9031c79848c22479fbe4fefd9fd5
-
SHA1
46cb43e8729f7cff222124fc1a25312368d9aa6b
-
SHA256
be257854203242015900e49fa115a811061681196e7f149db0473e92aa8e5528
-
SHA512
5678b86226689d02d22927e1d9e19372636a87da331f8c83f858e6beb0fcf5d324200fe3f73ad40715a81e073dfe62b20ef9af4f8b19b765944b2ef7ef028c51
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7uCYez3hrLCd0v5f55LGmUDAvqpoz9DNtb64F:/U5rCOTeiDuCYe1/nhHLvwoxRteXwNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2144 9E0.tmp 2752 A6C.tmp 2140 ADA.tmp 2624 B28.tmp 2692 B95.tmp 3064 C02.tmp 2596 C6F.tmp 2496 CDC.tmp 340 D3A.tmp 2484 DA7.tmp 2588 E34.tmp 2072 EA1.tmp 2168 EFE.tmp 2816 F6C.tmp 2952 FD9.tmp 1812 1036.tmp 1668 1084.tmp 1436 10E2.tmp 1740 1140.tmp 2528 11AD.tmp 2772 120A.tmp 1560 1278.tmp 2412 12C6.tmp 1500 1314.tmp 1276 1362.tmp 2056 13B0.tmp 2244 13EE.tmp 2448 143C.tmp 2164 147A.tmp 1964 14B9.tmp 700 14F7.tmp 988 1536.tmp 1484 1574.tmp 1476 15C2.tmp 1772 1600.tmp 2336 165E.tmp 1868 169C.tmp 452 16DB.tmp 1048 1719.tmp 2116 1767.tmp 1564 17B5.tmp 1924 1803.tmp 1628 1851.tmp 2876 189F.tmp 1040 18ED.tmp 908 192C.tmp 560 197A.tmp 840 19B8.tmp 2228 19F6.tmp 980 1A35.tmp 2204 1A73.tmp 2088 1AB2.tmp 1504 1AF0.tmp 2216 1B3E.tmp 1604 1B8C.tmp 1712 1BDA.tmp 1756 1C18.tmp 2064 1C57.tmp 2608 1CA5.tmp 2252 1D02.tmp 2672 1D50.tmp 2704 1DAE.tmp 2696 1DFC.tmp 2692 1E3A.tmp -
Loads dropped DLL 64 IoCs
pid Process 1804 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 2144 9E0.tmp 2752 A6C.tmp 2140 ADA.tmp 2624 B28.tmp 2692 B95.tmp 3064 C02.tmp 2596 C6F.tmp 2496 CDC.tmp 340 D3A.tmp 2484 DA7.tmp 2588 E34.tmp 2072 EA1.tmp 2168 EFE.tmp 2816 F6C.tmp 2952 FD9.tmp 1812 1036.tmp 1668 1084.tmp 1436 10E2.tmp 1740 1140.tmp 2528 11AD.tmp 2772 120A.tmp 1560 1278.tmp 2412 12C6.tmp 1500 1314.tmp 1276 1362.tmp 2056 13B0.tmp 2244 13EE.tmp 2448 143C.tmp 2164 147A.tmp 1964 14B9.tmp 700 14F7.tmp 988 1536.tmp 1484 1574.tmp 1476 15C2.tmp 1772 1600.tmp 2336 165E.tmp 1868 169C.tmp 452 16DB.tmp 1048 1719.tmp 2116 1767.tmp 1564 17B5.tmp 1924 1803.tmp 1628 1851.tmp 2876 189F.tmp 1040 18ED.tmp 908 192C.tmp 560 197A.tmp 840 19B8.tmp 2228 19F6.tmp 980 1A35.tmp 2204 1A73.tmp 2088 1AB2.tmp 1504 1AF0.tmp 2216 1B3E.tmp 1604 1B8C.tmp 1712 1BDA.tmp 1756 1C18.tmp 2064 1C57.tmp 2608 1CA5.tmp 2252 1D02.tmp 2672 1D50.tmp 2704 1DAE.tmp 2696 1DFC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2144 1804 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 28 PID 1804 wrote to memory of 2144 1804 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 28 PID 1804 wrote to memory of 2144 1804 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 28 PID 1804 wrote to memory of 2144 1804 2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe 28 PID 2144 wrote to memory of 2752 2144 9E0.tmp 29 PID 2144 wrote to memory of 2752 2144 9E0.tmp 29 PID 2144 wrote to memory of 2752 2144 9E0.tmp 29 PID 2144 wrote to memory of 2752 2144 9E0.tmp 29 PID 2752 wrote to memory of 2140 2752 A6C.tmp 30 PID 2752 wrote to memory of 2140 2752 A6C.tmp 30 PID 2752 wrote to memory of 2140 2752 A6C.tmp 30 PID 2752 wrote to memory of 2140 2752 A6C.tmp 30 PID 2140 wrote to memory of 2624 2140 ADA.tmp 31 PID 2140 wrote to memory of 2624 2140 ADA.tmp 31 PID 2140 wrote to memory of 2624 2140 ADA.tmp 31 PID 2140 wrote to memory of 2624 2140 ADA.tmp 31 PID 2624 wrote to memory of 2692 2624 B28.tmp 32 PID 2624 wrote to memory of 2692 2624 B28.tmp 32 PID 2624 wrote to memory of 2692 2624 B28.tmp 32 PID 2624 wrote to memory of 2692 2624 B28.tmp 32 PID 2692 wrote to memory of 3064 2692 B95.tmp 33 PID 2692 wrote to memory of 3064 2692 B95.tmp 33 PID 2692 wrote to memory of 3064 2692 B95.tmp 33 PID 2692 wrote to memory of 3064 2692 B95.tmp 33 PID 3064 wrote to memory of 2596 3064 C02.tmp 34 PID 3064 wrote to memory of 2596 3064 C02.tmp 34 PID 3064 wrote to memory of 2596 3064 C02.tmp 34 PID 3064 wrote to memory of 2596 3064 C02.tmp 34 PID 2596 wrote to memory of 2496 2596 C6F.tmp 35 PID 2596 wrote to memory of 2496 2596 C6F.tmp 35 PID 2596 wrote to memory of 2496 2596 C6F.tmp 35 PID 2596 wrote to memory of 2496 2596 C6F.tmp 35 PID 2496 wrote to memory of 340 2496 CDC.tmp 36 PID 2496 wrote to memory of 340 2496 CDC.tmp 36 PID 2496 wrote to memory of 340 2496 CDC.tmp 36 PID 2496 wrote to memory of 340 2496 CDC.tmp 36 PID 340 wrote to memory of 2484 340 D3A.tmp 37 PID 340 wrote to memory of 2484 340 D3A.tmp 37 PID 340 wrote to memory of 2484 340 D3A.tmp 37 PID 340 wrote to memory of 2484 340 D3A.tmp 37 PID 2484 wrote to memory of 2588 2484 DA7.tmp 38 PID 2484 wrote to memory of 2588 2484 DA7.tmp 38 PID 2484 wrote to memory of 2588 2484 DA7.tmp 38 PID 2484 wrote to memory of 2588 2484 DA7.tmp 38 PID 2588 wrote to memory of 2072 2588 E34.tmp 39 PID 2588 wrote to memory of 2072 2588 E34.tmp 39 PID 2588 wrote to memory of 2072 2588 E34.tmp 39 PID 2588 wrote to memory of 2072 2588 E34.tmp 39 PID 2072 wrote to memory of 2168 2072 EA1.tmp 40 PID 2072 wrote to memory of 2168 2072 EA1.tmp 40 PID 2072 wrote to memory of 2168 2072 EA1.tmp 40 PID 2072 wrote to memory of 2168 2072 EA1.tmp 40 PID 2168 wrote to memory of 2816 2168 EFE.tmp 41 PID 2168 wrote to memory of 2816 2168 EFE.tmp 41 PID 2168 wrote to memory of 2816 2168 EFE.tmp 41 PID 2168 wrote to memory of 2816 2168 EFE.tmp 41 PID 2816 wrote to memory of 2952 2816 F6C.tmp 42 PID 2816 wrote to memory of 2952 2816 F6C.tmp 42 PID 2816 wrote to memory of 2952 2816 F6C.tmp 42 PID 2816 wrote to memory of 2952 2816 F6C.tmp 42 PID 2952 wrote to memory of 1812 2952 FD9.tmp 43 PID 2952 wrote to memory of 1812 2952 FD9.tmp 43 PID 2952 wrote to memory of 1812 2952 FD9.tmp 43 PID 2952 wrote to memory of 1812 2952 FD9.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_969f9031c79848c22479fbe4fefd9fd5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"65⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"66⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"67⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"68⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"70⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"72⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"74⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"75⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"76⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"78⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"79⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"80⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"81⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"82⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"83⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"85⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"86⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"87⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"88⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"89⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"90⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"91⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"92⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"93⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"94⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"95⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"96⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"97⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"99⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"100⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"101⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"102⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"104⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"105⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"106⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"107⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"108⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"109⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"110⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"111⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"112⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"113⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"114⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"115⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"116⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"117⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"118⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"119⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"121⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-