Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe
-
Size
712KB
-
MD5
65348a0360bcb6116620ddecd1036795
-
SHA1
08de1a196f7452c12419a783c10c20aa3c857361
-
SHA256
933a94022aa3590ccde5d7e4eb1b8cc68be7c5ac15d4314cb6f36c49aad51eb8
-
SHA512
c346ab277c9506d4f52d8329dc5ff61715106214e18b6f192a92e8307a55359fb8ae3097d9b5f933c5d4672c0dd2923a0dccb36dccd1eec5f092b5cc1b814e02
-
SSDEEP
12288:FU5rCOTeiD4G0b2IYHGEzLh9qYvcW0xP3CvKNZdCvq5TJLCvY90D8/LVBlVk736j:FUQOJD43qbLfhEdW0xPyvKNnCvq5TJLT
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2172 1CC4.tmp 1060 1D12.tmp 2712 1D60.tmp 2564 1DAE.tmp 2644 1E0C.tmp 2548 1E5A.tmp 2672 1E98.tmp 2460 1EF6.tmp 2668 1F53.tmp 2664 1FA1.tmp 2484 1FEF.tmp 2476 204D.tmp 2000 20AA.tmp 2812 2108.tmp 2844 2166.tmp 2992 21B4.tmp 1308 2202.tmp 1632 225F.tmp 2160 229E.tmp 2400 22DC.tmp 1700 231A.tmp 2772 2359.tmp 1964 23A7.tmp 1092 23E5.tmp 1068 2424.tmp 2248 2462.tmp 2056 24A0.tmp 2600 24DF.tmp 2164 251D.tmp 2888 256B.tmp 1936 25AA.tmp 584 25E8.tmp 544 2626.tmp 1476 2665.tmp 640 26A3.tmp 1624 26E2.tmp 356 2720.tmp 1648 275E.tmp 452 27AC.tmp 2052 281A.tmp 2024 2877.tmp 2144 2971.tmp 1320 29DE.tmp 1380 2A7A.tmp 804 2AF7.tmp 2136 2B35.tmp 912 2B74.tmp 772 2BC2.tmp 1192 2C10.tmp 1908 2C5E.tmp 1980 2C9C.tmp 2256 2CEA.tmp 2372 2D28.tmp 2356 2D67.tmp 1444 2DB5.tmp 1676 2DF3.tmp 1704 2E32.tmp 2016 2E80.tmp 2180 2ECE.tmp 2176 2F0C.tmp 2556 2F5A.tmp 2700 2FB8.tmp 1568 3006.tmp 2436 3044.tmp -
Loads dropped DLL 64 IoCs
pid Process 1676 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 2172 1CC4.tmp 1060 1D12.tmp 2712 1D60.tmp 2564 1DAE.tmp 2644 1E0C.tmp 2548 1E5A.tmp 2672 1E98.tmp 2460 1EF6.tmp 2668 1F53.tmp 2664 1FA1.tmp 2484 1FEF.tmp 2476 204D.tmp 2000 20AA.tmp 2812 2108.tmp 2844 2166.tmp 2992 21B4.tmp 1308 2202.tmp 1632 225F.tmp 2160 229E.tmp 2400 22DC.tmp 1700 231A.tmp 2772 2359.tmp 1964 23A7.tmp 1092 23E5.tmp 1068 2424.tmp 2248 2462.tmp 2056 24A0.tmp 2600 24DF.tmp 2164 251D.tmp 2888 256B.tmp 1936 25AA.tmp 584 25E8.tmp 544 2626.tmp 1476 2665.tmp 640 26A3.tmp 1624 26E2.tmp 356 2720.tmp 1648 275E.tmp 452 27AC.tmp 2052 281A.tmp 2024 2877.tmp 2144 2971.tmp 1320 29DE.tmp 1380 2A7A.tmp 804 2AF7.tmp 2136 2B35.tmp 912 2B74.tmp 772 2BC2.tmp 1192 2C10.tmp 1908 2C5E.tmp 1980 2C9C.tmp 2256 2CEA.tmp 2372 2D28.tmp 2356 2D67.tmp 1444 2DB5.tmp 1676 2DF3.tmp 1704 2E32.tmp 2016 2E80.tmp 2180 2ECE.tmp 2176 2F0C.tmp 2556 2F5A.tmp 2700 2FB8.tmp 1568 3006.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2172 1676 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 28 PID 1676 wrote to memory of 2172 1676 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 28 PID 1676 wrote to memory of 2172 1676 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 28 PID 1676 wrote to memory of 2172 1676 2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe 28 PID 2172 wrote to memory of 1060 2172 1CC4.tmp 29 PID 2172 wrote to memory of 1060 2172 1CC4.tmp 29 PID 2172 wrote to memory of 1060 2172 1CC4.tmp 29 PID 2172 wrote to memory of 1060 2172 1CC4.tmp 29 PID 1060 wrote to memory of 2712 1060 1D12.tmp 30 PID 1060 wrote to memory of 2712 1060 1D12.tmp 30 PID 1060 wrote to memory of 2712 1060 1D12.tmp 30 PID 1060 wrote to memory of 2712 1060 1D12.tmp 30 PID 2712 wrote to memory of 2564 2712 1D60.tmp 31 PID 2712 wrote to memory of 2564 2712 1D60.tmp 31 PID 2712 wrote to memory of 2564 2712 1D60.tmp 31 PID 2712 wrote to memory of 2564 2712 1D60.tmp 31 PID 2564 wrote to memory of 2644 2564 1DAE.tmp 32 PID 2564 wrote to memory of 2644 2564 1DAE.tmp 32 PID 2564 wrote to memory of 2644 2564 1DAE.tmp 32 PID 2564 wrote to memory of 2644 2564 1DAE.tmp 32 PID 2644 wrote to memory of 2548 2644 1E0C.tmp 33 PID 2644 wrote to memory of 2548 2644 1E0C.tmp 33 PID 2644 wrote to memory of 2548 2644 1E0C.tmp 33 PID 2644 wrote to memory of 2548 2644 1E0C.tmp 33 PID 2548 wrote to memory of 2672 2548 1E5A.tmp 34 PID 2548 wrote to memory of 2672 2548 1E5A.tmp 34 PID 2548 wrote to memory of 2672 2548 1E5A.tmp 34 PID 2548 wrote to memory of 2672 2548 1E5A.tmp 34 PID 2672 wrote to memory of 2460 2672 1E98.tmp 35 PID 2672 wrote to memory of 2460 2672 1E98.tmp 35 PID 2672 wrote to memory of 2460 2672 1E98.tmp 35 PID 2672 wrote to memory of 2460 2672 1E98.tmp 35 PID 2460 wrote to memory of 2668 2460 1EF6.tmp 36 PID 2460 wrote to memory of 2668 2460 1EF6.tmp 36 PID 2460 wrote to memory of 2668 2460 1EF6.tmp 36 PID 2460 wrote to memory of 2668 2460 1EF6.tmp 36 PID 2668 wrote to memory of 2664 2668 1F53.tmp 37 PID 2668 wrote to memory of 2664 2668 1F53.tmp 37 PID 2668 wrote to memory of 2664 2668 1F53.tmp 37 PID 2668 wrote to memory of 2664 2668 1F53.tmp 37 PID 2664 wrote to memory of 2484 2664 1FA1.tmp 38 PID 2664 wrote to memory of 2484 2664 1FA1.tmp 38 PID 2664 wrote to memory of 2484 2664 1FA1.tmp 38 PID 2664 wrote to memory of 2484 2664 1FA1.tmp 38 PID 2484 wrote to memory of 2476 2484 1FEF.tmp 39 PID 2484 wrote to memory of 2476 2484 1FEF.tmp 39 PID 2484 wrote to memory of 2476 2484 1FEF.tmp 39 PID 2484 wrote to memory of 2476 2484 1FEF.tmp 39 PID 2476 wrote to memory of 2000 2476 204D.tmp 40 PID 2476 wrote to memory of 2000 2476 204D.tmp 40 PID 2476 wrote to memory of 2000 2476 204D.tmp 40 PID 2476 wrote to memory of 2000 2476 204D.tmp 40 PID 2000 wrote to memory of 2812 2000 20AA.tmp 41 PID 2000 wrote to memory of 2812 2000 20AA.tmp 41 PID 2000 wrote to memory of 2812 2000 20AA.tmp 41 PID 2000 wrote to memory of 2812 2000 20AA.tmp 41 PID 2812 wrote to memory of 2844 2812 2108.tmp 42 PID 2812 wrote to memory of 2844 2812 2108.tmp 42 PID 2812 wrote to memory of 2844 2812 2108.tmp 42 PID 2812 wrote to memory of 2844 2812 2108.tmp 42 PID 2844 wrote to memory of 2992 2844 2166.tmp 43 PID 2844 wrote to memory of 2992 2844 2166.tmp 43 PID 2844 wrote to memory of 2992 2844 2166.tmp 43 PID 2844 wrote to memory of 2992 2844 2166.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_65348a0360bcb6116620ddecd1036795_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"65⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"67⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"68⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"70⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"71⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"72⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"73⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"74⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"75⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"76⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"77⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"78⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"79⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"80⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"81⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"82⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"83⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"84⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"85⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"86⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"87⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"88⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"89⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"90⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"92⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"93⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"94⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"95⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"96⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"97⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"99⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"100⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"101⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"102⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"103⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"104⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"105⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"106⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"107⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"108⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"112⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"113⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"114⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"115⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"116⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"118⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"120⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"121⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"122⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-