Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe
-
Size
488KB
-
MD5
83dfa1e7c946e8aa352f928898051bc5
-
SHA1
678b5d4b1c9134cb55f5bfe51075cf6076286020
-
SHA256
ca8830e92c6eccb81cd026ee4c2b23e3b0305cb135923f202e876fdd6f51b0a5
-
SHA512
daa8ec52501d50b8530ad7c7fa971f886462bcb22bf474c71acaf9528669e914d845cd1831858508d358489fd074bcc992b900f52cf57f88b127537c55b1e8f4
-
SSDEEP
12288:/U5rCOTeiD3IbUDArL7mhjxbXUDD0iiGESNZ:/UQOJD3cUW72ZU/0pLSN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2980 C60.tmp 2920 CBD.tmp 3024 D3A.tmp 2612 D98.tmp 2712 E05.tmp 1352 E62.tmp 2752 EB0.tmp 2232 F0E.tmp 2520 F7B.tmp 2496 FC9.tmp 2872 1027.tmp 2164 1084.tmp 2344 10D2.tmp 1596 1130.tmp 2524 119D.tmp 1868 11FB.tmp 1856 1268.tmp 1684 12D5.tmp 2360 1333.tmp 2396 1390.tmp 1808 13EE.tmp 1532 144C.tmp 1580 14A9.tmp 1448 14E8.tmp 2300 1526.tmp 2112 1564.tmp 2820 15B2.tmp 2640 1600.tmp 1452 163F.tmp 2284 168D.tmp 596 16DB.tmp 576 1719.tmp 1500 1758.tmp 3020 1796.tmp 852 17E4.tmp 1036 1822.tmp 1556 1861.tmp 1152 18AF.tmp 2156 18FD.tmp 400 193B.tmp 1692 197A.tmp 2208 19C8.tmp 1636 1A06.tmp 1044 1A54.tmp 1064 1AA2.tmp 1008 1AF0.tmp 2832 1B3E.tmp 2012 1B8C.tmp 2260 1BCA.tmp 1744 1C09.tmp 2292 1C47.tmp 2040 1C86.tmp 1524 1CD4.tmp 2304 1D12.tmp 2148 1D60.tmp 2092 1D9E.tmp 2972 1DEC.tmp 3044 1E2B.tmp 1296 1E69.tmp 2748 1EA8.tmp 2796 1EE6.tmp 2592 1F24.tmp 2716 1F82.tmp 2800 1FC0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2904 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 2980 C60.tmp 2920 CBD.tmp 3024 D3A.tmp 2612 D98.tmp 2712 E05.tmp 1352 E62.tmp 2752 EB0.tmp 2232 F0E.tmp 2520 F7B.tmp 2496 FC9.tmp 2872 1027.tmp 2164 1084.tmp 2344 10D2.tmp 1596 1130.tmp 2524 119D.tmp 1868 11FB.tmp 1856 1268.tmp 1684 12D5.tmp 2360 1333.tmp 2396 1390.tmp 1808 13EE.tmp 1532 144C.tmp 1580 14A9.tmp 1448 14E8.tmp 2300 1526.tmp 2112 1564.tmp 2820 15B2.tmp 2640 1600.tmp 1452 163F.tmp 2284 168D.tmp 596 16DB.tmp 576 1719.tmp 1500 1758.tmp 3020 1796.tmp 852 17E4.tmp 1036 1822.tmp 1556 1861.tmp 1152 18AF.tmp 2156 18FD.tmp 400 193B.tmp 1692 197A.tmp 2208 19C8.tmp 1636 1A06.tmp 1044 1A54.tmp 1064 1AA2.tmp 1008 1AF0.tmp 2832 1B3E.tmp 2012 1B8C.tmp 2260 1BCA.tmp 1744 1C09.tmp 2292 1C47.tmp 2040 1C86.tmp 1524 1CD4.tmp 2304 1D12.tmp 2148 1D60.tmp 2092 1D9E.tmp 2972 1DEC.tmp 3044 1E2B.tmp 1296 1E69.tmp 2748 1EA8.tmp 2796 1EE6.tmp 2592 1F24.tmp 2716 1F82.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2980 2904 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 28 PID 2904 wrote to memory of 2980 2904 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 28 PID 2904 wrote to memory of 2980 2904 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 28 PID 2904 wrote to memory of 2980 2904 2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe 28 PID 2980 wrote to memory of 2920 2980 C60.tmp 29 PID 2980 wrote to memory of 2920 2980 C60.tmp 29 PID 2980 wrote to memory of 2920 2980 C60.tmp 29 PID 2980 wrote to memory of 2920 2980 C60.tmp 29 PID 2920 wrote to memory of 3024 2920 CBD.tmp 30 PID 2920 wrote to memory of 3024 2920 CBD.tmp 30 PID 2920 wrote to memory of 3024 2920 CBD.tmp 30 PID 2920 wrote to memory of 3024 2920 CBD.tmp 30 PID 3024 wrote to memory of 2612 3024 D3A.tmp 31 PID 3024 wrote to memory of 2612 3024 D3A.tmp 31 PID 3024 wrote to memory of 2612 3024 D3A.tmp 31 PID 3024 wrote to memory of 2612 3024 D3A.tmp 31 PID 2612 wrote to memory of 2712 2612 D98.tmp 32 PID 2612 wrote to memory of 2712 2612 D98.tmp 32 PID 2612 wrote to memory of 2712 2612 D98.tmp 32 PID 2612 wrote to memory of 2712 2612 D98.tmp 32 PID 2712 wrote to memory of 1352 2712 E05.tmp 33 PID 2712 wrote to memory of 1352 2712 E05.tmp 33 PID 2712 wrote to memory of 1352 2712 E05.tmp 33 PID 2712 wrote to memory of 1352 2712 E05.tmp 33 PID 1352 wrote to memory of 2752 1352 E62.tmp 34 PID 1352 wrote to memory of 2752 1352 E62.tmp 34 PID 1352 wrote to memory of 2752 1352 E62.tmp 34 PID 1352 wrote to memory of 2752 1352 E62.tmp 34 PID 2752 wrote to memory of 2232 2752 EB0.tmp 35 PID 2752 wrote to memory of 2232 2752 EB0.tmp 35 PID 2752 wrote to memory of 2232 2752 EB0.tmp 35 PID 2752 wrote to memory of 2232 2752 EB0.tmp 35 PID 2232 wrote to memory of 2520 2232 F0E.tmp 36 PID 2232 wrote to memory of 2520 2232 F0E.tmp 36 PID 2232 wrote to memory of 2520 2232 F0E.tmp 36 PID 2232 wrote to memory of 2520 2232 F0E.tmp 36 PID 2520 wrote to memory of 2496 2520 F7B.tmp 37 PID 2520 wrote to memory of 2496 2520 F7B.tmp 37 PID 2520 wrote to memory of 2496 2520 F7B.tmp 37 PID 2520 wrote to memory of 2496 2520 F7B.tmp 37 PID 2496 wrote to memory of 2872 2496 FC9.tmp 38 PID 2496 wrote to memory of 2872 2496 FC9.tmp 38 PID 2496 wrote to memory of 2872 2496 FC9.tmp 38 PID 2496 wrote to memory of 2872 2496 FC9.tmp 38 PID 2872 wrote to memory of 2164 2872 1027.tmp 39 PID 2872 wrote to memory of 2164 2872 1027.tmp 39 PID 2872 wrote to memory of 2164 2872 1027.tmp 39 PID 2872 wrote to memory of 2164 2872 1027.tmp 39 PID 2164 wrote to memory of 2344 2164 1084.tmp 40 PID 2164 wrote to memory of 2344 2164 1084.tmp 40 PID 2164 wrote to memory of 2344 2164 1084.tmp 40 PID 2164 wrote to memory of 2344 2164 1084.tmp 40 PID 2344 wrote to memory of 1596 2344 10D2.tmp 41 PID 2344 wrote to memory of 1596 2344 10D2.tmp 41 PID 2344 wrote to memory of 1596 2344 10D2.tmp 41 PID 2344 wrote to memory of 1596 2344 10D2.tmp 41 PID 1596 wrote to memory of 2524 1596 1130.tmp 42 PID 1596 wrote to memory of 2524 1596 1130.tmp 42 PID 1596 wrote to memory of 2524 1596 1130.tmp 42 PID 1596 wrote to memory of 2524 1596 1130.tmp 42 PID 2524 wrote to memory of 1868 2524 119D.tmp 43 PID 2524 wrote to memory of 1868 2524 119D.tmp 43 PID 2524 wrote to memory of 1868 2524 119D.tmp 43 PID 2524 wrote to memory of 1868 2524 119D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_83dfa1e7c946e8aa352f928898051bc5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"65⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"66⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"67⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"68⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"69⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"70⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"71⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"72⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"73⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"74⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"75⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"76⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"77⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"78⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"79⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"80⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"81⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"82⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"84⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"85⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"86⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"87⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"88⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"89⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"90⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"91⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"92⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"93⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"94⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"95⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"96⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"97⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"99⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"100⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"101⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"103⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"104⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"105⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"106⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"107⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"108⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"109⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"110⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"111⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"112⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"113⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"114⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"115⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"116⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"117⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"118⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"119⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"120⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"121⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"122⤵PID:2192
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-