Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 14:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe
-
Size
488KB
-
MD5
80105a437c1233aa6143af2a1f7f9253
-
SHA1
54550d8e30971aab1fc56b46905266984e8a2a52
-
SHA256
45ff2705e7afb533172a22e11994a29e155e8c84fceb49db0c6370e73fbb1800
-
SHA512
1a5a6014cc86c0c878dc1528067d7b5f2e9d9ae4222f8a57df4025eabb7c4ff1f9b855f7cc55537e2724495da347a87741787b461500c6164d9b4f5d69cdab52
-
SSDEEP
12288:/U5rCOTeiDfGYdpZAkmzac777VFaopYNZ:/UQOJDOWPAkt67idN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2316 4C1D.tmp 1092 4CC9.tmp 2460 4DA3.tmp 2572 4E8D.tmp 2856 4F29.tmp 2632 5004.tmp 2840 50BF.tmp 2804 516A.tmp 2420 5206.tmp 2360 52A2.tmp 2488 533E.tmp 2932 53DA.tmp 2300 5496.tmp 2728 5541.tmp 2756 55FC.tmp 2636 56D7.tmp 2276 5782.tmp 1184 586C.tmp 1728 5947.tmp 1612 59F2.tmp 668 5A7F.tmp 1288 5B3A.tmp 1628 5C05.tmp 2468 5C72.tmp 1096 5DE8.tmp 864 5E84.tmp 1456 5F9D.tmp 1276 600A.tmp 2544 6087.tmp 2800 6114.tmp 2220 6181.tmp 1932 61EE.tmp 2552 625B.tmp 2236 62D8.tmp 1596 6326.tmp 528 6374.tmp 884 6401.tmp 2068 646E.tmp 2056 64DB.tmp 2260 6558.tmp 816 65B5.tmp 968 6613.tmp 1332 6680.tmp 2324 66DE.tmp 1768 673B.tmp 880 67A9.tmp 684 6816.tmp 1048 6873.tmp 2284 68D1.tmp 300 693E.tmp 1588 69BB.tmp 2092 6A38.tmp 1964 6A95.tmp 2116 6AE3.tmp 1668 6B51.tmp 1268 6BCD.tmp 1292 6C4A.tmp 2560 6CA8.tmp 3068 6D05.tmp 2496 6D63.tmp 2460 6DC1.tmp 2604 6E3D.tmp 2492 6EAB.tmp 2856 6F18.tmp -
Loads dropped DLL 64 IoCs
pid Process 2304 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 2316 4C1D.tmp 1092 4CC9.tmp 2460 4DA3.tmp 2572 4E8D.tmp 2856 4F29.tmp 2632 5004.tmp 2840 50BF.tmp 2804 516A.tmp 2420 5206.tmp 2360 52A2.tmp 2488 533E.tmp 2932 53DA.tmp 2300 5496.tmp 2728 5541.tmp 2756 55FC.tmp 2636 56D7.tmp 2276 5782.tmp 1184 586C.tmp 1728 5947.tmp 1612 59F2.tmp 668 5A7F.tmp 1288 5B3A.tmp 1628 5C05.tmp 2468 5C72.tmp 1096 5DE8.tmp 864 5E84.tmp 1456 5F9D.tmp 1276 600A.tmp 2544 6087.tmp 2800 6114.tmp 2220 6181.tmp 1932 61EE.tmp 2552 625B.tmp 2236 62D8.tmp 1596 6326.tmp 528 6374.tmp 884 6401.tmp 2068 646E.tmp 2056 64DB.tmp 2260 6558.tmp 816 65B5.tmp 968 6613.tmp 1332 6680.tmp 2324 66DE.tmp 1768 673B.tmp 880 67A9.tmp 684 6816.tmp 1048 6873.tmp 2284 68D1.tmp 300 693E.tmp 1588 69BB.tmp 2092 6A38.tmp 1964 6A95.tmp 2116 6AE3.tmp 1668 6B51.tmp 1268 6BCD.tmp 1292 6C4A.tmp 2560 6CA8.tmp 3068 6D05.tmp 2496 6D63.tmp 2460 6DC1.tmp 2604 6E3D.tmp 2492 6EAB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2316 2304 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 28 PID 2304 wrote to memory of 2316 2304 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 28 PID 2304 wrote to memory of 2316 2304 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 28 PID 2304 wrote to memory of 2316 2304 2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe 28 PID 2316 wrote to memory of 1092 2316 4C1D.tmp 29 PID 2316 wrote to memory of 1092 2316 4C1D.tmp 29 PID 2316 wrote to memory of 1092 2316 4C1D.tmp 29 PID 2316 wrote to memory of 1092 2316 4C1D.tmp 29 PID 1092 wrote to memory of 2460 1092 4CC9.tmp 30 PID 1092 wrote to memory of 2460 1092 4CC9.tmp 30 PID 1092 wrote to memory of 2460 1092 4CC9.tmp 30 PID 1092 wrote to memory of 2460 1092 4CC9.tmp 30 PID 2460 wrote to memory of 2572 2460 4DA3.tmp 31 PID 2460 wrote to memory of 2572 2460 4DA3.tmp 31 PID 2460 wrote to memory of 2572 2460 4DA3.tmp 31 PID 2460 wrote to memory of 2572 2460 4DA3.tmp 31 PID 2572 wrote to memory of 2856 2572 4E8D.tmp 32 PID 2572 wrote to memory of 2856 2572 4E8D.tmp 32 PID 2572 wrote to memory of 2856 2572 4E8D.tmp 32 PID 2572 wrote to memory of 2856 2572 4E8D.tmp 32 PID 2856 wrote to memory of 2632 2856 4F29.tmp 33 PID 2856 wrote to memory of 2632 2856 4F29.tmp 33 PID 2856 wrote to memory of 2632 2856 4F29.tmp 33 PID 2856 wrote to memory of 2632 2856 4F29.tmp 33 PID 2632 wrote to memory of 2840 2632 5004.tmp 34 PID 2632 wrote to memory of 2840 2632 5004.tmp 34 PID 2632 wrote to memory of 2840 2632 5004.tmp 34 PID 2632 wrote to memory of 2840 2632 5004.tmp 34 PID 2840 wrote to memory of 2804 2840 50BF.tmp 35 PID 2840 wrote to memory of 2804 2840 50BF.tmp 35 PID 2840 wrote to memory of 2804 2840 50BF.tmp 35 PID 2840 wrote to memory of 2804 2840 50BF.tmp 35 PID 2804 wrote to memory of 2420 2804 516A.tmp 36 PID 2804 wrote to memory of 2420 2804 516A.tmp 36 PID 2804 wrote to memory of 2420 2804 516A.tmp 36 PID 2804 wrote to memory of 2420 2804 516A.tmp 36 PID 2420 wrote to memory of 2360 2420 5206.tmp 37 PID 2420 wrote to memory of 2360 2420 5206.tmp 37 PID 2420 wrote to memory of 2360 2420 5206.tmp 37 PID 2420 wrote to memory of 2360 2420 5206.tmp 37 PID 2360 wrote to memory of 2488 2360 52A2.tmp 38 PID 2360 wrote to memory of 2488 2360 52A2.tmp 38 PID 2360 wrote to memory of 2488 2360 52A2.tmp 38 PID 2360 wrote to memory of 2488 2360 52A2.tmp 38 PID 2488 wrote to memory of 2932 2488 533E.tmp 39 PID 2488 wrote to memory of 2932 2488 533E.tmp 39 PID 2488 wrote to memory of 2932 2488 533E.tmp 39 PID 2488 wrote to memory of 2932 2488 533E.tmp 39 PID 2932 wrote to memory of 2300 2932 53DA.tmp 40 PID 2932 wrote to memory of 2300 2932 53DA.tmp 40 PID 2932 wrote to memory of 2300 2932 53DA.tmp 40 PID 2932 wrote to memory of 2300 2932 53DA.tmp 40 PID 2300 wrote to memory of 2728 2300 5496.tmp 41 PID 2300 wrote to memory of 2728 2300 5496.tmp 41 PID 2300 wrote to memory of 2728 2300 5496.tmp 41 PID 2300 wrote to memory of 2728 2300 5496.tmp 41 PID 2728 wrote to memory of 2756 2728 5541.tmp 42 PID 2728 wrote to memory of 2756 2728 5541.tmp 42 PID 2728 wrote to memory of 2756 2728 5541.tmp 42 PID 2728 wrote to memory of 2756 2728 5541.tmp 42 PID 2756 wrote to memory of 2636 2756 55FC.tmp 43 PID 2756 wrote to memory of 2636 2756 55FC.tmp 43 PID 2756 wrote to memory of 2636 2756 55FC.tmp 43 PID 2756 wrote to memory of 2636 2756 55FC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_80105a437c1233aa6143af2a1f7f9253_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\5C72.tmp"C:\Users\Admin\AppData\Local\Temp\5C72.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\600A.tmp"C:\Users\Admin\AppData\Local\Temp\600A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\625B.tmp"C:\Users\Admin\AppData\Local\Temp\625B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\693E.tmp"C:\Users\Admin\AppData\Local\Temp\693E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"65⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"66⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"67⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"68⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"69⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"70⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"71⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"72⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"73⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"74⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"75⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"76⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"77⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"78⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"79⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"80⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"81⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"82⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"83⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"84⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"86⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"87⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"88⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"89⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"90⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"91⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"92⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"93⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"94⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"95⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"96⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"97⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"98⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"99⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"100⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\8057.tmp"C:\Users\Admin\AppData\Local\Temp\8057.tmp"101⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"102⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"103⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"104⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"105⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"106⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"107⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\8305.tmp"C:\Users\Admin\AppData\Local\Temp\8305.tmp"108⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"109⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"110⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"111⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"112⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"113⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"114⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"115⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"116⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"117⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"118⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"119⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"120⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"121⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-