Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe
-
Size
529KB
-
MD5
2ffbc20f800f1c8c5f8cea92aeb9fe03
-
SHA1
d8a519b8740f28b49b655a96ce8aa0518626e2df
-
SHA256
7fd4b80f69600293e8ca876c48d547eda5c81a1abc73018b58b44a550bc5f914
-
SHA512
c7e740e1c0a76b704e5c7e8eb4e9183dce4424ff67a28606820203696a5e2a169e28dfe6e7922df80bb119a2f102b833697a8e87d6e570d5c94ef41ba7a4aac6
-
SSDEEP
12288:NU5rCOTeij6PrvcQ2u1DHXiOErnvWuTZwlH4Hp:NUQOJjyvcQ2sbSDrVTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2696 6A95.tmp 2940 6B03.tmp 2604 6BED.tmp 2560 6C69.tmp 2412 6D53.tmp 2688 6DD0.tmp 2428 6E8B.tmp 2452 6F56.tmp 2424 7011.tmp 2836 709E.tmp 1804 712A.tmp 2164 71D6.tmp 676 7281.tmp 1020 734C.tmp 1360 7427.tmp 2864 74C3.tmp 2956 754F.tmp 2464 75FB.tmp 1948 7704.tmp 1404 77BF.tmp 1832 784B.tmp 1988 78C8.tmp 2268 7945.tmp 2672 79D1.tmp 836 7A4E.tmp 2324 7AFA.tmp 1104 7CBE.tmp 1760 7D4B.tmp 1748 7DD7.tmp 2304 7E44.tmp 2920 7EC1.tmp 2140 7F3E.tmp 2124 7FBB.tmp 2588 8037.tmp 1792 80A5.tmp 1072 8131.tmp 948 819E.tmp 2136 821B.tmp 1824 8298.tmp 2044 8324.tmp 1300 8391.tmp 1680 840E.tmp 1184 846C.tmp 2808 84E9.tmp 2036 8546.tmp 3032 85C3.tmp 1780 8640.tmp 2792 86DC.tmp 2016 8739.tmp 2820 87A7.tmp 536 8814.tmp 1604 8891.tmp 2796 88FE.tmp 1256 896B.tmp 3012 89D8.tmp 1616 8A55.tmp 2996 8AD2.tmp 3064 8B4F.tmp 2144 8BBC.tmp 2624 8C29.tmp 2532 8CA6.tmp 2768 8D23.tmp 2648 8D90.tmp 2736 8E0D.tmp -
Loads dropped DLL 64 IoCs
pid Process 3012 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 2696 6A95.tmp 2940 6B03.tmp 2604 6BED.tmp 2560 6C69.tmp 2412 6D53.tmp 2688 6DD0.tmp 2428 6E8B.tmp 2452 6F56.tmp 2424 7011.tmp 2836 709E.tmp 1804 712A.tmp 2164 71D6.tmp 676 7281.tmp 1020 734C.tmp 1360 7427.tmp 2864 74C3.tmp 2956 754F.tmp 2464 75FB.tmp 1948 7704.tmp 1404 77BF.tmp 1832 784B.tmp 1988 78C8.tmp 2268 7945.tmp 2672 79D1.tmp 836 7A4E.tmp 2324 7AFA.tmp 1104 7CBE.tmp 1760 7D4B.tmp 1748 7DD7.tmp 2304 7E44.tmp 2920 7EC1.tmp 2140 7F3E.tmp 2124 7FBB.tmp 2588 8037.tmp 1792 80A5.tmp 1072 8131.tmp 948 819E.tmp 2136 821B.tmp 1824 8298.tmp 2044 8324.tmp 1300 8391.tmp 1680 840E.tmp 1184 846C.tmp 2808 84E9.tmp 2036 8546.tmp 3032 85C3.tmp 1780 8640.tmp 2792 86DC.tmp 2016 8739.tmp 2820 87A7.tmp 536 8814.tmp 1604 8891.tmp 2796 88FE.tmp 1256 896B.tmp 3012 89D8.tmp 1616 8A55.tmp 2996 8AD2.tmp 3064 8B4F.tmp 2144 8BBC.tmp 2624 8C29.tmp 2532 8CA6.tmp 2768 8D23.tmp 2648 8D90.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2696 3012 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 28 PID 3012 wrote to memory of 2696 3012 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 28 PID 3012 wrote to memory of 2696 3012 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 28 PID 3012 wrote to memory of 2696 3012 2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe 28 PID 2696 wrote to memory of 2940 2696 6A95.tmp 29 PID 2696 wrote to memory of 2940 2696 6A95.tmp 29 PID 2696 wrote to memory of 2940 2696 6A95.tmp 29 PID 2696 wrote to memory of 2940 2696 6A95.tmp 29 PID 2940 wrote to memory of 2604 2940 6B03.tmp 30 PID 2940 wrote to memory of 2604 2940 6B03.tmp 30 PID 2940 wrote to memory of 2604 2940 6B03.tmp 30 PID 2940 wrote to memory of 2604 2940 6B03.tmp 30 PID 2604 wrote to memory of 2560 2604 6BED.tmp 31 PID 2604 wrote to memory of 2560 2604 6BED.tmp 31 PID 2604 wrote to memory of 2560 2604 6BED.tmp 31 PID 2604 wrote to memory of 2560 2604 6BED.tmp 31 PID 2560 wrote to memory of 2412 2560 6C69.tmp 32 PID 2560 wrote to memory of 2412 2560 6C69.tmp 32 PID 2560 wrote to memory of 2412 2560 6C69.tmp 32 PID 2560 wrote to memory of 2412 2560 6C69.tmp 32 PID 2412 wrote to memory of 2688 2412 6D53.tmp 33 PID 2412 wrote to memory of 2688 2412 6D53.tmp 33 PID 2412 wrote to memory of 2688 2412 6D53.tmp 33 PID 2412 wrote to memory of 2688 2412 6D53.tmp 33 PID 2688 wrote to memory of 2428 2688 6DD0.tmp 93 PID 2688 wrote to memory of 2428 2688 6DD0.tmp 93 PID 2688 wrote to memory of 2428 2688 6DD0.tmp 93 PID 2688 wrote to memory of 2428 2688 6DD0.tmp 93 PID 2428 wrote to memory of 2452 2428 6E8B.tmp 35 PID 2428 wrote to memory of 2452 2428 6E8B.tmp 35 PID 2428 wrote to memory of 2452 2428 6E8B.tmp 35 PID 2428 wrote to memory of 2452 2428 6E8B.tmp 35 PID 2452 wrote to memory of 2424 2452 6F56.tmp 36 PID 2452 wrote to memory of 2424 2452 6F56.tmp 36 PID 2452 wrote to memory of 2424 2452 6F56.tmp 36 PID 2452 wrote to memory of 2424 2452 6F56.tmp 36 PID 2424 wrote to memory of 2836 2424 7011.tmp 37 PID 2424 wrote to memory of 2836 2424 7011.tmp 37 PID 2424 wrote to memory of 2836 2424 7011.tmp 37 PID 2424 wrote to memory of 2836 2424 7011.tmp 37 PID 2836 wrote to memory of 1804 2836 709E.tmp 38 PID 2836 wrote to memory of 1804 2836 709E.tmp 38 PID 2836 wrote to memory of 1804 2836 709E.tmp 38 PID 2836 wrote to memory of 1804 2836 709E.tmp 38 PID 1804 wrote to memory of 2164 1804 712A.tmp 39 PID 1804 wrote to memory of 2164 1804 712A.tmp 39 PID 1804 wrote to memory of 2164 1804 712A.tmp 39 PID 1804 wrote to memory of 2164 1804 712A.tmp 39 PID 2164 wrote to memory of 676 2164 71D6.tmp 40 PID 2164 wrote to memory of 676 2164 71D6.tmp 40 PID 2164 wrote to memory of 676 2164 71D6.tmp 40 PID 2164 wrote to memory of 676 2164 71D6.tmp 40 PID 676 wrote to memory of 1020 676 7281.tmp 41 PID 676 wrote to memory of 1020 676 7281.tmp 41 PID 676 wrote to memory of 1020 676 7281.tmp 41 PID 676 wrote to memory of 1020 676 7281.tmp 41 PID 1020 wrote to memory of 1360 1020 734C.tmp 42 PID 1020 wrote to memory of 1360 1020 734C.tmp 42 PID 1020 wrote to memory of 1360 1020 734C.tmp 42 PID 1020 wrote to memory of 1360 1020 734C.tmp 42 PID 1360 wrote to memory of 2864 1360 7427.tmp 43 PID 1360 wrote to memory of 2864 1360 7427.tmp 43 PID 1360 wrote to memory of 2864 1360 7427.tmp 43 PID 1360 wrote to memory of 2864 1360 7427.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_2ffbc20f800f1c8c5f8cea92aeb9fe03_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"C:\Users\Admin\AppData\Local\Temp\6E8B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\7281.tmp"C:\Users\Admin\AppData\Local\Temp\7281.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"65⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"66⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"67⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"68⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"69⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"70⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"72⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"73⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"74⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"75⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"76⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"77⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"78⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"79⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"80⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"81⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"82⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\9972.tmp"C:\Users\Admin\AppData\Local\Temp\9972.tmp"83⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"84⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"85⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"86⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"87⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"88⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"89⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"90⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"91⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"92⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"93⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"94⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"95⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"96⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"97⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"98⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"99⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"100⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"101⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"102⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"103⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"104⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"105⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"106⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"107⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"108⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"109⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"111⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"112⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"113⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"115⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"116⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"117⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"118⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"119⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"120⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"121⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-