Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe
-
Size
529KB
-
MD5
116dc5cbe4af41a83c9d0051ecc3e029
-
SHA1
0c0dda5493fde03da670da425108c84d145f9165
-
SHA256
5bbb5f1180e68358e79b09ede1953357555eacf36789de361815219e69d6db3d
-
SHA512
e2dd1c17cbdb9f84a7805cffb4a4d5c941450d9e907969400e28ff403ccedfe767a4a2191340ef77ee9a12c50587aa9f1befee96b2c383f4350c5d134ded94a6
-
SSDEEP
12288:NU5rCOTeijkEf/+jW92OugK+4z89QhGL3rTZwlH4Hp:NUQOJjkK92OuPz89QEfTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2156 19B8.tmp 2924 1A16.tmp 2744 1AC1.tmp 2576 1B2E.tmp 2692 1B9C.tmp 2620 1C28.tmp 2824 1CA5.tmp 2748 1D31.tmp 2604 1DBE.tmp 2700 1E2B.tmp 2516 1E88.tmp 2928 1F05.tmp 2428 1F72.tmp 1556 1FEF.tmp 2764 205C.tmp 2784 20D9.tmp 1692 2137.tmp 884 21A4.tmp 1748 2202.tmp 288 228E.tmp 1660 22EC.tmp 2196 2368.tmp 1440 23D6.tmp 1500 2414.tmp 2564 2452.tmp 2244 2491.tmp 2320 24CF.tmp 2232 250E.tmp 2856 254C.tmp 2452 258A.tmp 2252 25C9.tmp 332 2607.tmp 1136 2646.tmp 2724 2684.tmp 2960 26C2.tmp 540 2710.tmp 1140 274F.tmp 836 278D.tmp 1076 27CC.tmp 2096 280A.tmp 2536 2848.tmp 1516 2896.tmp 1680 28D5.tmp 1004 2913.tmp 896 2952.tmp 680 2990.tmp 2952 29CE.tmp 3028 2A0D.tmp 1576 2A4B.tmp 2112 2A8A.tmp 888 2AC8.tmp 2416 2B06.tmp 1332 2B45.tmp 1584 2B83.tmp 1776 2BC2.tmp 2872 2C00.tmp 2880 2C3E.tmp 2816 2C8C.tmp 2560 2CCB.tmp 3016 2D09.tmp 2680 2D48.tmp 2576 2D86.tmp 2612 2DC4.tmp 2332 2E03.tmp -
Loads dropped DLL 64 IoCs
pid Process 2180 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 2156 19B8.tmp 2924 1A16.tmp 2744 1AC1.tmp 2576 1B2E.tmp 2692 1B9C.tmp 2620 1C28.tmp 2824 1CA5.tmp 2748 1D31.tmp 2604 1DBE.tmp 2700 1E2B.tmp 2516 1E88.tmp 2928 1F05.tmp 2428 1F72.tmp 1556 1FEF.tmp 2764 205C.tmp 2784 20D9.tmp 1692 2137.tmp 884 21A4.tmp 1748 2202.tmp 288 228E.tmp 1660 22EC.tmp 2196 2368.tmp 1440 23D6.tmp 1500 2414.tmp 2564 2452.tmp 2244 2491.tmp 2320 24CF.tmp 2232 250E.tmp 2856 254C.tmp 2452 258A.tmp 2252 25C9.tmp 332 2607.tmp 1136 2646.tmp 2724 2684.tmp 2960 26C2.tmp 540 2710.tmp 1140 274F.tmp 836 278D.tmp 1076 27CC.tmp 2096 280A.tmp 2536 2848.tmp 1516 2896.tmp 1680 28D5.tmp 1004 2913.tmp 896 2952.tmp 680 2990.tmp 2952 29CE.tmp 3028 2A0D.tmp 1576 2A4B.tmp 2112 2A8A.tmp 888 2AC8.tmp 2416 2B06.tmp 1332 2B45.tmp 1584 2B83.tmp 1776 2BC2.tmp 2872 2C00.tmp 2880 2C3E.tmp 2816 2C8C.tmp 2560 2CCB.tmp 3016 2D09.tmp 2680 2D48.tmp 2576 2D86.tmp 2612 2DC4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2156 2180 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 29 PID 2180 wrote to memory of 2156 2180 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 29 PID 2180 wrote to memory of 2156 2180 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 29 PID 2180 wrote to memory of 2156 2180 2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe 29 PID 2156 wrote to memory of 2924 2156 19B8.tmp 30 PID 2156 wrote to memory of 2924 2156 19B8.tmp 30 PID 2156 wrote to memory of 2924 2156 19B8.tmp 30 PID 2156 wrote to memory of 2924 2156 19B8.tmp 30 PID 2924 wrote to memory of 2744 2924 1A16.tmp 31 PID 2924 wrote to memory of 2744 2924 1A16.tmp 31 PID 2924 wrote to memory of 2744 2924 1A16.tmp 31 PID 2924 wrote to memory of 2744 2924 1A16.tmp 31 PID 2744 wrote to memory of 2576 2744 1AC1.tmp 32 PID 2744 wrote to memory of 2576 2744 1AC1.tmp 32 PID 2744 wrote to memory of 2576 2744 1AC1.tmp 32 PID 2744 wrote to memory of 2576 2744 1AC1.tmp 32 PID 2576 wrote to memory of 2692 2576 1B2E.tmp 33 PID 2576 wrote to memory of 2692 2576 1B2E.tmp 33 PID 2576 wrote to memory of 2692 2576 1B2E.tmp 33 PID 2576 wrote to memory of 2692 2576 1B2E.tmp 33 PID 2692 wrote to memory of 2620 2692 1B9C.tmp 34 PID 2692 wrote to memory of 2620 2692 1B9C.tmp 34 PID 2692 wrote to memory of 2620 2692 1B9C.tmp 34 PID 2692 wrote to memory of 2620 2692 1B9C.tmp 34 PID 2620 wrote to memory of 2824 2620 1C28.tmp 35 PID 2620 wrote to memory of 2824 2620 1C28.tmp 35 PID 2620 wrote to memory of 2824 2620 1C28.tmp 35 PID 2620 wrote to memory of 2824 2620 1C28.tmp 35 PID 2824 wrote to memory of 2748 2824 1CA5.tmp 36 PID 2824 wrote to memory of 2748 2824 1CA5.tmp 36 PID 2824 wrote to memory of 2748 2824 1CA5.tmp 36 PID 2824 wrote to memory of 2748 2824 1CA5.tmp 36 PID 2748 wrote to memory of 2604 2748 1D31.tmp 37 PID 2748 wrote to memory of 2604 2748 1D31.tmp 37 PID 2748 wrote to memory of 2604 2748 1D31.tmp 37 PID 2748 wrote to memory of 2604 2748 1D31.tmp 37 PID 2604 wrote to memory of 2700 2604 1DBE.tmp 38 PID 2604 wrote to memory of 2700 2604 1DBE.tmp 38 PID 2604 wrote to memory of 2700 2604 1DBE.tmp 38 PID 2604 wrote to memory of 2700 2604 1DBE.tmp 38 PID 2700 wrote to memory of 2516 2700 1E2B.tmp 39 PID 2700 wrote to memory of 2516 2700 1E2B.tmp 39 PID 2700 wrote to memory of 2516 2700 1E2B.tmp 39 PID 2700 wrote to memory of 2516 2700 1E2B.tmp 39 PID 2516 wrote to memory of 2928 2516 1E88.tmp 40 PID 2516 wrote to memory of 2928 2516 1E88.tmp 40 PID 2516 wrote to memory of 2928 2516 1E88.tmp 40 PID 2516 wrote to memory of 2928 2516 1E88.tmp 40 PID 2928 wrote to memory of 2428 2928 1F05.tmp 41 PID 2928 wrote to memory of 2428 2928 1F05.tmp 41 PID 2928 wrote to memory of 2428 2928 1F05.tmp 41 PID 2928 wrote to memory of 2428 2928 1F05.tmp 41 PID 2428 wrote to memory of 1556 2428 1F72.tmp 42 PID 2428 wrote to memory of 1556 2428 1F72.tmp 42 PID 2428 wrote to memory of 1556 2428 1F72.tmp 42 PID 2428 wrote to memory of 1556 2428 1F72.tmp 42 PID 1556 wrote to memory of 2764 1556 1FEF.tmp 43 PID 1556 wrote to memory of 2764 1556 1FEF.tmp 43 PID 1556 wrote to memory of 2764 1556 1FEF.tmp 43 PID 1556 wrote to memory of 2764 1556 1FEF.tmp 43 PID 2764 wrote to memory of 2784 2764 205C.tmp 44 PID 2764 wrote to memory of 2784 2764 205C.tmp 44 PID 2764 wrote to memory of 2784 2764 205C.tmp 44 PID 2764 wrote to memory of 2784 2764 205C.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_116dc5cbe4af41a83c9d0051ecc3e029_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"65⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"68⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"69⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"70⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"71⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"72⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"73⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"74⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"75⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"76⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"77⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"78⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"79⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"80⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"81⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"82⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"83⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"85⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"87⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"88⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"89⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"90⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"91⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"93⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"94⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"96⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"97⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"98⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"99⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"100⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"101⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"102⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"103⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"104⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"105⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"106⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"107⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"108⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"109⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"110⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"111⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"112⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"113⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"114⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"115⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"116⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"117⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"118⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"119⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"120⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"121⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-