Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe
-
Size
536KB
-
MD5
a9ed4ab657b19ac769a76557ccd2f489
-
SHA1
87b856c2cfe8ba8be905b46f01f188cef31db8b7
-
SHA256
4cf6ddb87630da9e70162e2da95dfad692278a5a48c3c4cba37bf856cc4ba509
-
SHA512
07c2e43cd6fbb0380eeee3b288adb0e7e51c4415d433f7f2727ceb5d1a0e69383959f82edbf0419bc0ed6da2d79e8a4b81bf2cd2b567cc7159e05a18b79b10a4
-
SSDEEP
12288:wU5rCOTeiUvs8rXMal47mz1Xkr4IZxVJ0ZT9:wUQOJU0Sjl/+4IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3040 751.tmp 2132 80C.tmp 2840 906.tmp 2576 9D0.tmp 2892 A8C.tmp 2596 AE9.tmp 2560 B47.tmp 2644 B85.tmp 2416 BE3.tmp 2804 C50.tmp 2748 CAE.tmp 2412 CFC.tmp 1524 D59.tmp 2468 DB7.tmp 1512 E14.tmp 2536 E72.tmp 1776 ED0.tmp 1652 F2D.tmp 1696 F8B.tmp 2956 FE8.tmp 2360 1046.tmp 2544 10A4.tmp 2284 1101.tmp 1012 115F.tmp 1116 11AD.tmp 1992 120A.tmp 1312 1268.tmp 2472 12C6.tmp 1288 1323.tmp 612 1381.tmp 1752 13EE.tmp 976 144C.tmp 2200 14A9.tmp 2268 14F7.tmp 956 1555.tmp 1788 15B2.tmp 856 1610.tmp 2248 166E.tmp 2280 16CB.tmp 1720 1719.tmp 2512 1777.tmp 1604 17C5.tmp 2460 1822.tmp 1780 1880.tmp 2768 18DE.tmp 2944 193B.tmp 2696 1999.tmp 2868 19F6.tmp 2604 1A64.tmp 1912 1AC1.tmp 2904 1B1F.tmp 2588 1B7C.tmp 2896 1BDA.tmp 2848 1C28.tmp 3044 1C86.tmp 1772 1CC4.tmp 1080 1D12.tmp 2916 1D8F.tmp 1416 1DDD.tmp 1880 1E3A.tmp 1316 1EA8.tmp 1980 1F44.tmp 1872 1F82.tmp 1544 1FD0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2500 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 3040 751.tmp 2132 80C.tmp 2840 906.tmp 2576 9D0.tmp 2892 A8C.tmp 2596 AE9.tmp 2560 B47.tmp 2644 B85.tmp 2416 BE3.tmp 2804 C50.tmp 2748 CAE.tmp 2412 CFC.tmp 1524 D59.tmp 2468 DB7.tmp 1512 E14.tmp 2536 E72.tmp 1776 ED0.tmp 1652 F2D.tmp 1696 F8B.tmp 2956 FE8.tmp 2360 1046.tmp 2544 10A4.tmp 2284 1101.tmp 1012 115F.tmp 1116 11AD.tmp 1992 120A.tmp 1312 1268.tmp 2472 12C6.tmp 1288 1323.tmp 612 1381.tmp 1752 13EE.tmp 976 144C.tmp 2200 14A9.tmp 2268 14F7.tmp 956 1555.tmp 1788 15B2.tmp 856 1610.tmp 2248 166E.tmp 2280 16CB.tmp 1720 1719.tmp 2512 1777.tmp 1604 17C5.tmp 2460 1822.tmp 1780 1880.tmp 2768 18DE.tmp 2944 193B.tmp 2696 1999.tmp 2868 19F6.tmp 2604 1A64.tmp 1912 1AC1.tmp 2904 1B1F.tmp 2588 1B7C.tmp 2896 1BDA.tmp 2848 1C28.tmp 3044 1C86.tmp 1772 1CC4.tmp 1080 1D12.tmp 2916 1D8F.tmp 1416 1DDD.tmp 1880 1E3A.tmp 1316 1EA8.tmp 1980 1F44.tmp 1872 1F82.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3040 2500 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 28 PID 2500 wrote to memory of 3040 2500 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 28 PID 2500 wrote to memory of 3040 2500 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 28 PID 2500 wrote to memory of 3040 2500 2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe 28 PID 3040 wrote to memory of 2132 3040 751.tmp 29 PID 3040 wrote to memory of 2132 3040 751.tmp 29 PID 3040 wrote to memory of 2132 3040 751.tmp 29 PID 3040 wrote to memory of 2132 3040 751.tmp 29 PID 2132 wrote to memory of 2840 2132 80C.tmp 30 PID 2132 wrote to memory of 2840 2132 80C.tmp 30 PID 2132 wrote to memory of 2840 2132 80C.tmp 30 PID 2132 wrote to memory of 2840 2132 80C.tmp 30 PID 2840 wrote to memory of 2576 2840 906.tmp 31 PID 2840 wrote to memory of 2576 2840 906.tmp 31 PID 2840 wrote to memory of 2576 2840 906.tmp 31 PID 2840 wrote to memory of 2576 2840 906.tmp 31 PID 2576 wrote to memory of 2892 2576 9D0.tmp 32 PID 2576 wrote to memory of 2892 2576 9D0.tmp 32 PID 2576 wrote to memory of 2892 2576 9D0.tmp 32 PID 2576 wrote to memory of 2892 2576 9D0.tmp 32 PID 2892 wrote to memory of 2596 2892 A8C.tmp 33 PID 2892 wrote to memory of 2596 2892 A8C.tmp 33 PID 2892 wrote to memory of 2596 2892 A8C.tmp 33 PID 2892 wrote to memory of 2596 2892 A8C.tmp 33 PID 2596 wrote to memory of 2560 2596 AE9.tmp 34 PID 2596 wrote to memory of 2560 2596 AE9.tmp 34 PID 2596 wrote to memory of 2560 2596 AE9.tmp 34 PID 2596 wrote to memory of 2560 2596 AE9.tmp 34 PID 2560 wrote to memory of 2644 2560 B47.tmp 35 PID 2560 wrote to memory of 2644 2560 B47.tmp 35 PID 2560 wrote to memory of 2644 2560 B47.tmp 35 PID 2560 wrote to memory of 2644 2560 B47.tmp 35 PID 2644 wrote to memory of 2416 2644 B85.tmp 36 PID 2644 wrote to memory of 2416 2644 B85.tmp 36 PID 2644 wrote to memory of 2416 2644 B85.tmp 36 PID 2644 wrote to memory of 2416 2644 B85.tmp 36 PID 2416 wrote to memory of 2804 2416 BE3.tmp 37 PID 2416 wrote to memory of 2804 2416 BE3.tmp 37 PID 2416 wrote to memory of 2804 2416 BE3.tmp 37 PID 2416 wrote to memory of 2804 2416 BE3.tmp 37 PID 2804 wrote to memory of 2748 2804 C50.tmp 38 PID 2804 wrote to memory of 2748 2804 C50.tmp 38 PID 2804 wrote to memory of 2748 2804 C50.tmp 38 PID 2804 wrote to memory of 2748 2804 C50.tmp 38 PID 2748 wrote to memory of 2412 2748 CAE.tmp 39 PID 2748 wrote to memory of 2412 2748 CAE.tmp 39 PID 2748 wrote to memory of 2412 2748 CAE.tmp 39 PID 2748 wrote to memory of 2412 2748 CAE.tmp 39 PID 2412 wrote to memory of 1524 2412 CFC.tmp 40 PID 2412 wrote to memory of 1524 2412 CFC.tmp 40 PID 2412 wrote to memory of 1524 2412 CFC.tmp 40 PID 2412 wrote to memory of 1524 2412 CFC.tmp 40 PID 1524 wrote to memory of 2468 1524 D59.tmp 41 PID 1524 wrote to memory of 2468 1524 D59.tmp 41 PID 1524 wrote to memory of 2468 1524 D59.tmp 41 PID 1524 wrote to memory of 2468 1524 D59.tmp 41 PID 2468 wrote to memory of 1512 2468 DB7.tmp 42 PID 2468 wrote to memory of 1512 2468 DB7.tmp 42 PID 2468 wrote to memory of 1512 2468 DB7.tmp 42 PID 2468 wrote to memory of 1512 2468 DB7.tmp 42 PID 1512 wrote to memory of 2536 1512 E14.tmp 43 PID 1512 wrote to memory of 2536 1512 E14.tmp 43 PID 1512 wrote to memory of 2536 1512 E14.tmp 43 PID 1512 wrote to memory of 2536 1512 E14.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_a9ed4ab657b19ac769a76557ccd2f489_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"65⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"67⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"68⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"69⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"70⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"71⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"72⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"73⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"74⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"75⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"76⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"77⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"78⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"79⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"80⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"81⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"82⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"83⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"84⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"85⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"86⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"87⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"88⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"89⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"90⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"91⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"92⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"93⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"94⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"95⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"96⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"97⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"98⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"99⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"100⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"101⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"102⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"103⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"104⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"105⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"106⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"107⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"108⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"109⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"110⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"111⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"112⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"113⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"114⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"115⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"116⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"117⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"118⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"119⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"120⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"121⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-