Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe
-
Size
536KB
-
MD5
608f39a26a891dd2b198a47c54373ba5
-
SHA1
7c545df5eb11d2eb07d6ff12cea3dbd8b57b2bac
-
SHA256
39f77b63c43bc08ccdb7757d100c746ea1467ac801e8d4e094829ddf16f1995a
-
SHA512
2baadd85fc63b3eada3a97d612dfd9c1e4cd9309f079a30663f6e18b4594d8eb5d7a554ad011bbab4d2cadb3275169ee2f7bde5cd307e957b24ab5560ce80f29
-
SSDEEP
12288:wU5rCOTeiUXEIk693y6zVp6RG2KIZxVJ0ZT9:wUQOJUXGmzVP2KIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1276 1F34.tmp 3004 1FD0.tmp 2660 201E.tmp 2720 20F8.tmp 2804 2156.tmp 2552 2240.tmp 2680 22DC.tmp 2536 2378.tmp 2984 2424.tmp 1924 24B0.tmp 2852 255C.tmp 2968 2617.tmp 376 26C2.tmp 760 276E.tmp 1412 281A.tmp 1960 28C5.tmp 1572 2904.tmp 868 29A0.tmp 1236 2A2C.tmp 1488 2AE7.tmp 2712 2B35.tmp 532 2C00.tmp 652 2CDA.tmp 920 2D19.tmp 1812 2D86.tmp 2472 2DE4.tmp 408 2E41.tmp 616 2E80.tmp 1768 2EED.tmp 276 2F5A.tmp 2944 2FB8.tmp 2964 3006.tmp 600 3063.tmp 2932 30B1.tmp 2144 312E.tmp 2364 319B.tmp 2152 3228.tmp 1952 32B4.tmp 2252 3321.tmp 1704 337F.tmp 2060 33BD.tmp 2192 33FC.tmp 2724 343A.tmp 2728 3478.tmp 2784 34B7.tmp 2896 3505.tmp 2672 3543.tmp 2860 3591.tmp 2276 35D0.tmp 2568 360E.tmp 2680 364C.tmp 2980 369A.tmp 2760 36E8.tmp 2848 3736.tmp 2880 3784.tmp 836 37C3.tmp 3000 3811.tmp 2008 385F.tmp 1996 389D.tmp 1036 38DC.tmp 792 391A.tmp 1620 3968.tmp 2576 39A6.tmp 1580 39E5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2416 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 1276 1F34.tmp 3004 1FD0.tmp 2660 201E.tmp 2720 20F8.tmp 2804 2156.tmp 2552 2240.tmp 2680 22DC.tmp 2536 2378.tmp 2984 2424.tmp 1924 24B0.tmp 2852 255C.tmp 2968 2617.tmp 376 26C2.tmp 760 276E.tmp 1412 281A.tmp 1960 28C5.tmp 1572 2904.tmp 868 29A0.tmp 1236 2A2C.tmp 1488 2AE7.tmp 2712 2B35.tmp 532 2C00.tmp 652 2CDA.tmp 920 2D19.tmp 1812 2D86.tmp 2472 2DE4.tmp 408 2E41.tmp 616 2E80.tmp 1768 2EED.tmp 276 2F5A.tmp 2944 2FB8.tmp 2964 3006.tmp 600 3063.tmp 2932 30B1.tmp 2144 312E.tmp 2364 319B.tmp 2152 3228.tmp 1952 32B4.tmp 2252 3321.tmp 1704 337F.tmp 2060 33BD.tmp 2192 33FC.tmp 2724 343A.tmp 2728 3478.tmp 2784 34B7.tmp 2896 3505.tmp 2672 3543.tmp 2860 3591.tmp 2276 35D0.tmp 2568 360E.tmp 2680 364C.tmp 2980 369A.tmp 2760 36E8.tmp 2848 3736.tmp 2880 3784.tmp 836 37C3.tmp 3000 3811.tmp 2008 385F.tmp 1996 389D.tmp 1036 38DC.tmp 792 391A.tmp 1620 3968.tmp 2576 39A6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1276 2416 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 28 PID 2416 wrote to memory of 1276 2416 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 28 PID 2416 wrote to memory of 1276 2416 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 28 PID 2416 wrote to memory of 1276 2416 2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe 28 PID 1276 wrote to memory of 3004 1276 1F34.tmp 29 PID 1276 wrote to memory of 3004 1276 1F34.tmp 29 PID 1276 wrote to memory of 3004 1276 1F34.tmp 29 PID 1276 wrote to memory of 3004 1276 1F34.tmp 29 PID 3004 wrote to memory of 2660 3004 1FD0.tmp 30 PID 3004 wrote to memory of 2660 3004 1FD0.tmp 30 PID 3004 wrote to memory of 2660 3004 1FD0.tmp 30 PID 3004 wrote to memory of 2660 3004 1FD0.tmp 30 PID 2660 wrote to memory of 2720 2660 201E.tmp 31 PID 2660 wrote to memory of 2720 2660 201E.tmp 31 PID 2660 wrote to memory of 2720 2660 201E.tmp 31 PID 2660 wrote to memory of 2720 2660 201E.tmp 31 PID 2720 wrote to memory of 2804 2720 20F8.tmp 32 PID 2720 wrote to memory of 2804 2720 20F8.tmp 32 PID 2720 wrote to memory of 2804 2720 20F8.tmp 32 PID 2720 wrote to memory of 2804 2720 20F8.tmp 32 PID 2804 wrote to memory of 2552 2804 2156.tmp 33 PID 2804 wrote to memory of 2552 2804 2156.tmp 33 PID 2804 wrote to memory of 2552 2804 2156.tmp 33 PID 2804 wrote to memory of 2552 2804 2156.tmp 33 PID 2552 wrote to memory of 2680 2552 2240.tmp 34 PID 2552 wrote to memory of 2680 2552 2240.tmp 34 PID 2552 wrote to memory of 2680 2552 2240.tmp 34 PID 2552 wrote to memory of 2680 2552 2240.tmp 34 PID 2680 wrote to memory of 2536 2680 22DC.tmp 35 PID 2680 wrote to memory of 2536 2680 22DC.tmp 35 PID 2680 wrote to memory of 2536 2680 22DC.tmp 35 PID 2680 wrote to memory of 2536 2680 22DC.tmp 35 PID 2536 wrote to memory of 2984 2536 2378.tmp 36 PID 2536 wrote to memory of 2984 2536 2378.tmp 36 PID 2536 wrote to memory of 2984 2536 2378.tmp 36 PID 2536 wrote to memory of 2984 2536 2378.tmp 36 PID 2984 wrote to memory of 1924 2984 2424.tmp 37 PID 2984 wrote to memory of 1924 2984 2424.tmp 37 PID 2984 wrote to memory of 1924 2984 2424.tmp 37 PID 2984 wrote to memory of 1924 2984 2424.tmp 37 PID 1924 wrote to memory of 2852 1924 24B0.tmp 38 PID 1924 wrote to memory of 2852 1924 24B0.tmp 38 PID 1924 wrote to memory of 2852 1924 24B0.tmp 38 PID 1924 wrote to memory of 2852 1924 24B0.tmp 38 PID 2852 wrote to memory of 2968 2852 255C.tmp 39 PID 2852 wrote to memory of 2968 2852 255C.tmp 39 PID 2852 wrote to memory of 2968 2852 255C.tmp 39 PID 2852 wrote to memory of 2968 2852 255C.tmp 39 PID 2968 wrote to memory of 376 2968 2617.tmp 40 PID 2968 wrote to memory of 376 2968 2617.tmp 40 PID 2968 wrote to memory of 376 2968 2617.tmp 40 PID 2968 wrote to memory of 376 2968 2617.tmp 40 PID 376 wrote to memory of 760 376 26C2.tmp 41 PID 376 wrote to memory of 760 376 26C2.tmp 41 PID 376 wrote to memory of 760 376 26C2.tmp 41 PID 376 wrote to memory of 760 376 26C2.tmp 41 PID 760 wrote to memory of 1412 760 276E.tmp 42 PID 760 wrote to memory of 1412 760 276E.tmp 42 PID 760 wrote to memory of 1412 760 276E.tmp 42 PID 760 wrote to memory of 1412 760 276E.tmp 42 PID 1412 wrote to memory of 1960 1412 281A.tmp 43 PID 1412 wrote to memory of 1960 1412 281A.tmp 43 PID 1412 wrote to memory of 1960 1412 281A.tmp 43 PID 1412 wrote to memory of 1960 1412 281A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_608f39a26a891dd2b198a47c54373ba5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"65⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"66⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"67⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"68⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"69⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"70⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"71⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"72⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"73⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"74⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"75⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"76⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"77⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"78⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"79⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"81⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"82⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"83⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"84⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"85⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"86⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"87⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"88⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"89⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"90⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"91⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"92⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"93⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"94⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"95⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"96⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"97⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"99⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"100⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"101⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"102⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"103⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"104⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"105⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"106⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"107⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"108⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"109⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"110⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"111⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"113⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"114⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"115⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"116⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"117⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"118⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"119⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"120⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"121⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-