Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe
-
Size
529KB
-
MD5
7330cf38eb875dcd59ee07dab6c7fe2c
-
SHA1
b0506e16dfce7b8de01c9b7b7d9c8296c45798d6
-
SHA256
db58ae982d931446703dc904e4c9ba59f019b3cf00fcc2584f844729c214917a
-
SHA512
444d9ae101907401db30fdfbd1e6b073f8bcd74b5562b3722f2aeb4f90635806c4c2447de5de8d0eb4b37fc911eafced5f356049bc9c92202314591660ca200a
-
SSDEEP
12288:NU5rCOTeijLVgHzH4KpQhalKh9u4XBMnITZwlH4Hp:NUQOJjRyzYBhalAXBMnITSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 384 12A6.tmp 2980 1314.tmp 2560 1381.tmp 2812 13FE.tmp 2628 146B.tmp 2796 14D8.tmp 2624 1545.tmp 308 15C2.tmp 2388 162F.tmp 2500 169C.tmp 2900 170A.tmp 2608 1786.tmp 2708 17E4.tmp 2728 1851.tmp 1636 189F.tmp 1880 18FD.tmp 780 195A.tmp 320 19D7.tmp 1612 1A44.tmp 2636 1AB2.tmp 1432 1B1F.tmp 1376 1B7C.tmp 2476 1BCA.tmp 2888 1C09.tmp 2164 1C47.tmp 2212 1C86.tmp 2580 1CC4.tmp 2200 1D02.tmp 268 1D50.tmp 788 1D9E.tmp 1428 1DDD.tmp 2820 1E1B.tmp 1788 1E69.tmp 1320 1EA8.tmp 2348 1EF6.tmp 1272 1F44.tmp 2992 1F82.tmp 1624 1FC0.tmp 3028 1FFF.tmp 2004 203D.tmp 1496 208B.tmp 976 20CA.tmp 240 2108.tmp 712 2146.tmp 1020 2185.tmp 2068 21C3.tmp 2124 2202.tmp 2220 2240.tmp 2920 227E.tmp 1676 22BD.tmp 2948 22FB.tmp 912 233A.tmp 2784 2378.tmp 2144 23B6.tmp 1520 23F5.tmp 2588 2433.tmp 2956 2481.tmp 2488 24CF.tmp 2524 250E.tmp 2584 255C.tmp 2600 25AA.tmp 2644 25E8.tmp 2384 2626.tmp 2656 2665.tmp -
Loads dropped DLL 64 IoCs
pid Process 2288 2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe 384 12A6.tmp 2980 1314.tmp 2560 1381.tmp 2812 13FE.tmp 2628 146B.tmp 2796 14D8.tmp 2624 1545.tmp 308 15C2.tmp 2388 162F.tmp 2500 169C.tmp 2900 170A.tmp 2608 1786.tmp 2708 17E4.tmp 2728 1851.tmp 1636 189F.tmp 1880 18FD.tmp 780 195A.tmp 320 19D7.tmp 1612 1A44.tmp 2636 1AB2.tmp 1432 1B1F.tmp 1376 1B7C.tmp 2476 1BCA.tmp 2888 1C09.tmp 2164 1C47.tmp 2212 1C86.tmp 2580 1CC4.tmp 2200 1D02.tmp 268 1D50.tmp 788 1D9E.tmp 1428 1DDD.tmp 2820 1E1B.tmp 1788 1E69.tmp 1320 1EA8.tmp 2348 1EF6.tmp 1272 1F44.tmp 2992 1F82.tmp 1624 1FC0.tmp 3028 1FFF.tmp 2004 203D.tmp 1496 208B.tmp 976 20CA.tmp 240 2108.tmp 712 2146.tmp 1020 2185.tmp 2068 21C3.tmp 2124 2202.tmp 2220 2240.tmp 2920 227E.tmp 1676 22BD.tmp 2948 22FB.tmp 912 233A.tmp 2784 2378.tmp 2144 23B6.tmp 1520 23F5.tmp 2588 2433.tmp 2956 2481.tmp 2488 24CF.tmp 2524 250E.tmp 2584 255C.tmp 2600 25AA.tmp 2644 25E8.tmp 2384 2626.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 384 2288 2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe 28 PID 2288 wrote to memory of 384 2288 2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe 28 PID 2288 wrote to memory of 384 2288 2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe 28 PID 2288 wrote to memory of 384 2288 2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe 28 PID 384 wrote to memory of 2980 384 12A6.tmp 29 PID 384 wrote to memory of 2980 384 12A6.tmp 29 PID 384 wrote to memory of 2980 384 12A6.tmp 29 PID 384 wrote to memory of 2980 384 12A6.tmp 29 PID 2980 wrote to memory of 2560 2980 1314.tmp 30 PID 2980 wrote to memory of 2560 2980 1314.tmp 30 PID 2980 wrote to memory of 2560 2980 1314.tmp 30 PID 2980 wrote to memory of 2560 2980 1314.tmp 30 PID 2560 wrote to memory of 2812 2560 1381.tmp 31 PID 2560 wrote to memory of 2812 2560 1381.tmp 31 PID 2560 wrote to memory of 2812 2560 1381.tmp 31 PID 2560 wrote to memory of 2812 2560 1381.tmp 31 PID 2812 wrote to memory of 2628 2812 13FE.tmp 32 PID 2812 wrote to memory of 2628 2812 13FE.tmp 32 PID 2812 wrote to memory of 2628 2812 13FE.tmp 32 PID 2812 wrote to memory of 2628 2812 13FE.tmp 32 PID 2628 wrote to memory of 2796 2628 146B.tmp 33 PID 2628 wrote to memory of 2796 2628 146B.tmp 33 PID 2628 wrote to memory of 2796 2628 146B.tmp 33 PID 2628 wrote to memory of 2796 2628 146B.tmp 33 PID 2796 wrote to memory of 2624 2796 14D8.tmp 34 PID 2796 wrote to memory of 2624 2796 14D8.tmp 34 PID 2796 wrote to memory of 2624 2796 14D8.tmp 34 PID 2796 wrote to memory of 2624 2796 14D8.tmp 34 PID 2624 wrote to memory of 308 2624 1545.tmp 35 PID 2624 wrote to memory of 308 2624 1545.tmp 35 PID 2624 wrote to memory of 308 2624 1545.tmp 35 PID 2624 wrote to memory of 308 2624 1545.tmp 35 PID 308 wrote to memory of 2388 308 15C2.tmp 36 PID 308 wrote to memory of 2388 308 15C2.tmp 36 PID 308 wrote to memory of 2388 308 15C2.tmp 36 PID 308 wrote to memory of 2388 308 15C2.tmp 36 PID 2388 wrote to memory of 2500 2388 162F.tmp 37 PID 2388 wrote to memory of 2500 2388 162F.tmp 37 PID 2388 wrote to memory of 2500 2388 162F.tmp 37 PID 2388 wrote to memory of 2500 2388 162F.tmp 37 PID 2500 wrote to memory of 2900 2500 169C.tmp 38 PID 2500 wrote to memory of 2900 2500 169C.tmp 38 PID 2500 wrote to memory of 2900 2500 169C.tmp 38 PID 2500 wrote to memory of 2900 2500 169C.tmp 38 PID 2900 wrote to memory of 2608 2900 170A.tmp 39 PID 2900 wrote to memory of 2608 2900 170A.tmp 39 PID 2900 wrote to memory of 2608 2900 170A.tmp 39 PID 2900 wrote to memory of 2608 2900 170A.tmp 39 PID 2608 wrote to memory of 2708 2608 1786.tmp 40 PID 2608 wrote to memory of 2708 2608 1786.tmp 40 PID 2608 wrote to memory of 2708 2608 1786.tmp 40 PID 2608 wrote to memory of 2708 2608 1786.tmp 40 PID 2708 wrote to memory of 2728 2708 17E4.tmp 41 PID 2708 wrote to memory of 2728 2708 17E4.tmp 41 PID 2708 wrote to memory of 2728 2708 17E4.tmp 41 PID 2708 wrote to memory of 2728 2708 17E4.tmp 41 PID 2728 wrote to memory of 1636 2728 1851.tmp 42 PID 2728 wrote to memory of 1636 2728 1851.tmp 42 PID 2728 wrote to memory of 1636 2728 1851.tmp 42 PID 2728 wrote to memory of 1636 2728 1851.tmp 42 PID 1636 wrote to memory of 1880 1636 189F.tmp 43 PID 1636 wrote to memory of 1880 1636 189F.tmp 43 PID 1636 wrote to memory of 1880 1636 189F.tmp 43 PID 1636 wrote to memory of 1880 1636 189F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_7330cf38eb875dcd59ee07dab6c7fe2c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"65⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"66⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"67⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"68⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"69⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"70⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"71⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"72⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"73⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"74⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"75⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"76⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"77⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"78⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"79⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"80⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"81⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"82⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"83⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"84⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"85⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"86⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"87⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"88⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"89⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"90⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"91⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"92⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"93⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"94⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"95⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"96⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"97⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"98⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"100⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"101⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"102⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"103⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"104⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"105⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"106⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"107⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"108⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"109⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"111⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"112⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"113⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"114⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"115⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"116⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"117⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"118⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"119⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"120⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"121⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-