Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe
-
Size
530KB
-
MD5
e932c6703b8fb89074ae1f550975077d
-
SHA1
5af2e62679ca057dd64202a056f461511394a9b6
-
SHA256
d415b785a340979b22d973daed1dee2121d63381be3c990bc96dd0c5adc7d440
-
SHA512
5b0307131d5d3958f75f02e37ae568ce11f4120269bc45c0f4e8822a0d69d42d4ee64b07549ac027f440822bc1a637bd5d4fa2da0340ff46997ab7a39364bdeb
-
SSDEEP
12288:AU5rCOTeio8SarHCUgKgUI+W/d7J9CNZulFVg0M1:AUQOJogrHCUgKaJ9CNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1744 DA7.tmp 2840 E05.tmp 2640 E53.tmp 2752 ED0.tmp 2664 F5C.tmp 2652 FD9.tmp 2776 1056.tmp 2708 10D2.tmp 2540 114F.tmp 2612 11BC.tmp 2764 122A.tmp 1624 1297.tmp 2604 1314.tmp 2852 1371.tmp 2968 13EE.tmp 2336 145B.tmp 1812 14D8.tmp 1808 1545.tmp 1672 15B2.tmp 2220 162F.tmp 308 168D.tmp 1592 16FA.tmp 1604 1758.tmp 1640 1796.tmp 1376 17D4.tmp 1432 1813.tmp 2516 1861.tmp 3044 189F.tmp 1988 18DE.tmp 264 191C.tmp 772 195A.tmp 1292 19A8.tmp 1492 19E7.tmp 2052 1A25.tmp 1696 1A64.tmp 1940 1AA2.tmp 2064 1AE0.tmp 1132 1B1F.tmp 1156 1B5D.tmp 2276 1B9C.tmp 1760 1BEA.tmp 1784 1C28.tmp 1328 1C66.tmp 2364 1CA5.tmp 1876 1CE3.tmp 1884 1D22.tmp 1148 1D70.tmp 1992 1DAE.tmp 1836 1DEC.tmp 2176 1E2B.tmp 2932 1E69.tmp 3008 1EA8.tmp 868 1EF6.tmp 2948 1F34.tmp 2184 1F72.tmp 1084 1FB1.tmp 1612 1FFF.tmp 2164 204D.tmp 2644 209B.tmp 2684 20D9.tmp 2760 2118.tmp 2692 2156.tmp 2544 2194.tmp 2660 21E2.tmp -
Loads dropped DLL 64 IoCs
pid Process 2432 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 1744 DA7.tmp 2840 E05.tmp 2640 E53.tmp 2752 ED0.tmp 2664 F5C.tmp 2652 FD9.tmp 2776 1056.tmp 2708 10D2.tmp 2540 114F.tmp 2612 11BC.tmp 2764 122A.tmp 1624 1297.tmp 2604 1314.tmp 2852 1371.tmp 2968 13EE.tmp 2336 145B.tmp 1812 14D8.tmp 1808 1545.tmp 1672 15B2.tmp 2220 162F.tmp 308 168D.tmp 1592 16FA.tmp 1604 1758.tmp 1640 1796.tmp 1376 17D4.tmp 1432 1813.tmp 2516 1861.tmp 3044 189F.tmp 1988 18DE.tmp 264 191C.tmp 772 195A.tmp 1292 19A8.tmp 1492 19E7.tmp 2052 1A25.tmp 1696 1A64.tmp 1940 1AA2.tmp 2064 1AE0.tmp 1132 1B1F.tmp 1156 1B5D.tmp 2276 1B9C.tmp 1760 1BEA.tmp 1784 1C28.tmp 1328 1C66.tmp 2364 1CA5.tmp 1876 1CE3.tmp 1884 1D22.tmp 1148 1D70.tmp 1992 1DAE.tmp 1836 1DEC.tmp 2176 1E2B.tmp 2932 1E69.tmp 3008 1EA8.tmp 868 1EF6.tmp 2948 1F34.tmp 2184 1F72.tmp 1084 1FB1.tmp 1612 1FFF.tmp 2164 204D.tmp 2644 209B.tmp 2684 20D9.tmp 2760 2118.tmp 2692 2156.tmp 2544 2194.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1744 2432 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 28 PID 2432 wrote to memory of 1744 2432 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 28 PID 2432 wrote to memory of 1744 2432 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 28 PID 2432 wrote to memory of 1744 2432 2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe 28 PID 1744 wrote to memory of 2840 1744 DA7.tmp 29 PID 1744 wrote to memory of 2840 1744 DA7.tmp 29 PID 1744 wrote to memory of 2840 1744 DA7.tmp 29 PID 1744 wrote to memory of 2840 1744 DA7.tmp 29 PID 2840 wrote to memory of 2640 2840 E05.tmp 30 PID 2840 wrote to memory of 2640 2840 E05.tmp 30 PID 2840 wrote to memory of 2640 2840 E05.tmp 30 PID 2840 wrote to memory of 2640 2840 E05.tmp 30 PID 2640 wrote to memory of 2752 2640 E53.tmp 31 PID 2640 wrote to memory of 2752 2640 E53.tmp 31 PID 2640 wrote to memory of 2752 2640 E53.tmp 31 PID 2640 wrote to memory of 2752 2640 E53.tmp 31 PID 2752 wrote to memory of 2664 2752 ED0.tmp 32 PID 2752 wrote to memory of 2664 2752 ED0.tmp 32 PID 2752 wrote to memory of 2664 2752 ED0.tmp 32 PID 2752 wrote to memory of 2664 2752 ED0.tmp 32 PID 2664 wrote to memory of 2652 2664 F5C.tmp 33 PID 2664 wrote to memory of 2652 2664 F5C.tmp 33 PID 2664 wrote to memory of 2652 2664 F5C.tmp 33 PID 2664 wrote to memory of 2652 2664 F5C.tmp 33 PID 2652 wrote to memory of 2776 2652 FD9.tmp 34 PID 2652 wrote to memory of 2776 2652 FD9.tmp 34 PID 2652 wrote to memory of 2776 2652 FD9.tmp 34 PID 2652 wrote to memory of 2776 2652 FD9.tmp 34 PID 2776 wrote to memory of 2708 2776 1056.tmp 35 PID 2776 wrote to memory of 2708 2776 1056.tmp 35 PID 2776 wrote to memory of 2708 2776 1056.tmp 35 PID 2776 wrote to memory of 2708 2776 1056.tmp 35 PID 2708 wrote to memory of 2540 2708 10D2.tmp 36 PID 2708 wrote to memory of 2540 2708 10D2.tmp 36 PID 2708 wrote to memory of 2540 2708 10D2.tmp 36 PID 2708 wrote to memory of 2540 2708 10D2.tmp 36 PID 2540 wrote to memory of 2612 2540 114F.tmp 37 PID 2540 wrote to memory of 2612 2540 114F.tmp 37 PID 2540 wrote to memory of 2612 2540 114F.tmp 37 PID 2540 wrote to memory of 2612 2540 114F.tmp 37 PID 2612 wrote to memory of 2764 2612 11BC.tmp 38 PID 2612 wrote to memory of 2764 2612 11BC.tmp 38 PID 2612 wrote to memory of 2764 2612 11BC.tmp 38 PID 2612 wrote to memory of 2764 2612 11BC.tmp 38 PID 2764 wrote to memory of 1624 2764 122A.tmp 39 PID 2764 wrote to memory of 1624 2764 122A.tmp 39 PID 2764 wrote to memory of 1624 2764 122A.tmp 39 PID 2764 wrote to memory of 1624 2764 122A.tmp 39 PID 1624 wrote to memory of 2604 1624 1297.tmp 40 PID 1624 wrote to memory of 2604 1624 1297.tmp 40 PID 1624 wrote to memory of 2604 1624 1297.tmp 40 PID 1624 wrote to memory of 2604 1624 1297.tmp 40 PID 2604 wrote to memory of 2852 2604 1314.tmp 41 PID 2604 wrote to memory of 2852 2604 1314.tmp 41 PID 2604 wrote to memory of 2852 2604 1314.tmp 41 PID 2604 wrote to memory of 2852 2604 1314.tmp 41 PID 2852 wrote to memory of 2968 2852 1371.tmp 42 PID 2852 wrote to memory of 2968 2852 1371.tmp 42 PID 2852 wrote to memory of 2968 2852 1371.tmp 42 PID 2852 wrote to memory of 2968 2852 1371.tmp 42 PID 2968 wrote to memory of 2336 2968 13EE.tmp 43 PID 2968 wrote to memory of 2336 2968 13EE.tmp 43 PID 2968 wrote to memory of 2336 2968 13EE.tmp 43 PID 2968 wrote to memory of 2336 2968 13EE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_e932c6703b8fb89074ae1f550975077d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"65⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"66⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"67⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"68⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"69⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"70⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"71⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"72⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"73⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"74⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"76⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"77⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"78⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"79⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"80⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"81⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"82⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"83⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"84⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"85⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"86⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"87⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"88⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"89⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"90⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"91⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"92⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"94⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"95⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"96⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"97⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"98⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"99⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"100⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"101⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"102⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"103⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"104⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"105⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"106⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"107⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"108⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"109⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"111⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"112⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"113⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"114⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"115⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"117⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"118⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"119⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"120⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"122⤵PID:1244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-