Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 01:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe
-
Size
520KB
-
MD5
89dba48782b4a009a6c24fbb227cb22c
-
SHA1
7f727e89b0da6a6cb24a7fbf910d27107eb15922
-
SHA256
5e845b35271b2f8d541f50f44d654f451e170ffdb05c25705a082b34fd24636d
-
SHA512
cf3b340ed53f55c25ce287d4dcf872d2446a5e5c2113f89bbd745c1e4ee106abbe87a3f5cbfe49cdae7097a480b4d361601d30f7f9953b51ea2231e6f440b9c7
-
SSDEEP
12288:roRXOQjmOy7chz8KKCFLOJk9Wx9NSag6brj1vdPh8qNZ:rogQ9yGd3XQx9vbf1vdP+qN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2148 16FA.tmp 2180 1777.tmp 3032 17F4.tmp 2560 1832.tmp 2684 18AF.tmp 2548 191C.tmp 2692 1999.tmp 2924 1A06.tmp 2672 1A73.tmp 2464 1AF0.tmp 2892 1B4E.tmp 2912 1BAB.tmp 2112 1C18.tmp 2492 1CA5.tmp 2736 1D22.tmp 2160 1D9E.tmp 1464 1E1B.tmp 1516 1E79.tmp 1396 1EE6.tmp 1332 1F53.tmp 2072 1FC0.tmp 2040 202E.tmp 2008 208B.tmp 2268 20D9.tmp 2860 2118.tmp 2236 2156.tmp 1728 2194.tmp 1352 21D3.tmp 1920 2211.tmp 536 225F.tmp 908 229E.tmp 1652 22EC.tmp 1636 232A.tmp 824 2368.tmp 1740 23B6.tmp 2400 23F5.tmp 2288 2433.tmp 1884 2481.tmp 1084 24C0.tmp 2616 250E.tmp 324 254C.tmp 1536 259A.tmp 956 25D8.tmp 980 2626.tmp 2096 2665.tmp 2812 26A3.tmp 2936 26E2.tmp 1976 2720.tmp 632 275E.tmp 3060 279D.tmp 2120 27DB.tmp 880 281A.tmp 2660 2868.tmp 2372 28B6.tmp 2360 2952.tmp 2968 2990.tmp 2964 29DE.tmp 2992 2A1C.tmp 2572 2A6A.tmp 3032 2AB8.tmp 2560 2B06.tmp 3012 2B54.tmp 2684 2B93.tmp 2520 2BE1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2140 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 2148 16FA.tmp 2180 1777.tmp 3032 17F4.tmp 2560 1832.tmp 2684 18AF.tmp 2548 191C.tmp 2692 1999.tmp 2924 1A06.tmp 2672 1A73.tmp 2464 1AF0.tmp 2892 1B4E.tmp 2912 1BAB.tmp 2112 1C18.tmp 2492 1CA5.tmp 2736 1D22.tmp 2160 1D9E.tmp 1464 1E1B.tmp 1516 1E79.tmp 1396 1EE6.tmp 1332 1F53.tmp 2072 1FC0.tmp 2040 202E.tmp 2008 208B.tmp 2268 20D9.tmp 2860 2118.tmp 2236 2156.tmp 1728 2194.tmp 1352 21D3.tmp 1920 2211.tmp 536 225F.tmp 908 229E.tmp 1652 22EC.tmp 1636 232A.tmp 824 2368.tmp 1740 23B6.tmp 2400 23F5.tmp 2288 2433.tmp 1884 2481.tmp 1084 24C0.tmp 2616 250E.tmp 324 254C.tmp 1536 259A.tmp 956 25D8.tmp 980 2626.tmp 2096 2665.tmp 2812 26A3.tmp 2936 26E2.tmp 1976 2720.tmp 632 275E.tmp 3060 279D.tmp 2120 27DB.tmp 880 281A.tmp 2660 2868.tmp 1472 28F4.tmp 2360 2952.tmp 2968 2990.tmp 2964 29DE.tmp 2992 2A1C.tmp 2572 2A6A.tmp 3032 2AB8.tmp 2560 2B06.tmp 3012 2B54.tmp 2684 2B93.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2148 2140 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 29 PID 2140 wrote to memory of 2148 2140 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 29 PID 2140 wrote to memory of 2148 2140 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 29 PID 2140 wrote to memory of 2148 2140 2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe 29 PID 2148 wrote to memory of 2180 2148 16FA.tmp 30 PID 2148 wrote to memory of 2180 2148 16FA.tmp 30 PID 2148 wrote to memory of 2180 2148 16FA.tmp 30 PID 2148 wrote to memory of 2180 2148 16FA.tmp 30 PID 2180 wrote to memory of 3032 2180 1777.tmp 31 PID 2180 wrote to memory of 3032 2180 1777.tmp 31 PID 2180 wrote to memory of 3032 2180 1777.tmp 31 PID 2180 wrote to memory of 3032 2180 1777.tmp 31 PID 3032 wrote to memory of 2560 3032 17F4.tmp 32 PID 3032 wrote to memory of 2560 3032 17F4.tmp 32 PID 3032 wrote to memory of 2560 3032 17F4.tmp 32 PID 3032 wrote to memory of 2560 3032 17F4.tmp 32 PID 2560 wrote to memory of 2684 2560 1832.tmp 33 PID 2560 wrote to memory of 2684 2560 1832.tmp 33 PID 2560 wrote to memory of 2684 2560 1832.tmp 33 PID 2560 wrote to memory of 2684 2560 1832.tmp 33 PID 2684 wrote to memory of 2548 2684 18AF.tmp 34 PID 2684 wrote to memory of 2548 2684 18AF.tmp 34 PID 2684 wrote to memory of 2548 2684 18AF.tmp 34 PID 2684 wrote to memory of 2548 2684 18AF.tmp 34 PID 2548 wrote to memory of 2692 2548 191C.tmp 35 PID 2548 wrote to memory of 2692 2548 191C.tmp 35 PID 2548 wrote to memory of 2692 2548 191C.tmp 35 PID 2548 wrote to memory of 2692 2548 191C.tmp 35 PID 2692 wrote to memory of 2924 2692 1999.tmp 36 PID 2692 wrote to memory of 2924 2692 1999.tmp 36 PID 2692 wrote to memory of 2924 2692 1999.tmp 36 PID 2692 wrote to memory of 2924 2692 1999.tmp 36 PID 2924 wrote to memory of 2672 2924 1A06.tmp 37 PID 2924 wrote to memory of 2672 2924 1A06.tmp 37 PID 2924 wrote to memory of 2672 2924 1A06.tmp 37 PID 2924 wrote to memory of 2672 2924 1A06.tmp 37 PID 2672 wrote to memory of 2464 2672 1A73.tmp 38 PID 2672 wrote to memory of 2464 2672 1A73.tmp 38 PID 2672 wrote to memory of 2464 2672 1A73.tmp 38 PID 2672 wrote to memory of 2464 2672 1A73.tmp 38 PID 2464 wrote to memory of 2892 2464 1AF0.tmp 39 PID 2464 wrote to memory of 2892 2464 1AF0.tmp 39 PID 2464 wrote to memory of 2892 2464 1AF0.tmp 39 PID 2464 wrote to memory of 2892 2464 1AF0.tmp 39 PID 2892 wrote to memory of 2912 2892 1B4E.tmp 40 PID 2892 wrote to memory of 2912 2892 1B4E.tmp 40 PID 2892 wrote to memory of 2912 2892 1B4E.tmp 40 PID 2892 wrote to memory of 2912 2892 1B4E.tmp 40 PID 2912 wrote to memory of 2112 2912 1BAB.tmp 41 PID 2912 wrote to memory of 2112 2912 1BAB.tmp 41 PID 2912 wrote to memory of 2112 2912 1BAB.tmp 41 PID 2912 wrote to memory of 2112 2912 1BAB.tmp 41 PID 2112 wrote to memory of 2492 2112 1C18.tmp 42 PID 2112 wrote to memory of 2492 2112 1C18.tmp 42 PID 2112 wrote to memory of 2492 2112 1C18.tmp 42 PID 2112 wrote to memory of 2492 2112 1C18.tmp 42 PID 2492 wrote to memory of 2736 2492 1CA5.tmp 43 PID 2492 wrote to memory of 2736 2492 1CA5.tmp 43 PID 2492 wrote to memory of 2736 2492 1CA5.tmp 43 PID 2492 wrote to memory of 2736 2492 1CA5.tmp 43 PID 2736 wrote to memory of 2160 2736 1D22.tmp 44 PID 2736 wrote to memory of 2160 2736 1D22.tmp 44 PID 2736 wrote to memory of 2160 2736 1D22.tmp 44 PID 2736 wrote to memory of 2160 2736 1D22.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_89dba48782b4a009a6c24fbb227cb22c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"55⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"56⤵
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"66⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"67⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"68⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"69⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"70⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"71⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"73⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"74⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"75⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"76⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"77⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"78⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"79⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"80⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"81⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"82⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"83⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"84⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"85⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"86⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"87⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"88⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"89⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"90⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"91⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"92⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"93⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"94⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"95⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"96⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"97⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"98⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"99⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"100⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"101⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"103⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"104⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"105⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"106⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"107⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"108⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"109⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"110⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"111⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"112⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"113⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"114⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"115⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"116⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"117⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"118⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"119⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"120⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"121⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-