Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe
-
Size
527KB
-
MD5
f830b64849a4da17271b149880472af1
-
SHA1
33ce5c8e94307d4edecc207b3454e730d5eea351
-
SHA256
6abbff928fdbe6159bedad121bc27ecee57b2a850c1ade586c0e3449ab23db13
-
SHA512
f61ea7ec20fa9c5e880898dbc932a3230a274a4da8f240862f404667106010f0d7509973fc28b6b3a420f825dbf26321477ca6f5ab8f219ffe33edef9795115f
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYifGyu3njp0jCFMqAqmXy7wCEIRrpwuY9ojeE:fU5rCOTeidJGyuXt64wy7rbW9RXDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2220 2D76.tmp 2928 2E12.tmp 2004 2ECE.tmp 2632 2F2B.tmp 2584 2FC7.tmp 2840 3073.tmp 2452 311E.tmp 2724 31AB.tmp 2640 3237.tmp 2484 32B4.tmp 3020 32F2.tmp 1816 337F.tmp 2816 341B.tmp 2972 34A7.tmp 2976 3534.tmp 2060 35DF.tmp 1048 367B.tmp 284 36E8.tmp 2168 3775.tmp 320 3820.tmp 804 38BC.tmp 2708 3958.tmp 944 39C6.tmp 1032 3A14.tmp 860 3A62.tmp 1328 3AB0.tmp 2028 3AEE.tmp 1268 3B3C.tmp 2068 3B8A.tmp 2408 3BD8.tmp 2288 3C26.tmp 2052 3C74.tmp 2096 3CC2.tmp 1804 3D00.tmp 2008 3D4E.tmp 1124 3D9C.tmp 3036 3DEA.tmp 1140 3E38.tmp 2384 3E86.tmp 1556 3ED4.tmp 1964 3F22.tmp 1840 3F70.tmp 792 3FBE.tmp 2256 400C.tmp 1044 405A.tmp 1616 40A8.tmp 652 4106.tmp 3012 4154.tmp 3004 41A2.tmp 1020 41F0.tmp 2996 423E.tmp 1580 428C.tmp 2160 42DA.tmp 1940 4318.tmp 1576 4366.tmp 1600 43B4.tmp 1704 4402.tmp 2220 4441.tmp 2568 449E.tmp 2536 44DD.tmp 3064 452B.tmp 2572 4579.tmp 2560 45D6.tmp 2588 4624.tmp -
Loads dropped DLL 64 IoCs
pid Process 2188 2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe 2220 2D76.tmp 2928 2E12.tmp 2004 2ECE.tmp 2632 2F2B.tmp 2584 2FC7.tmp 2840 3073.tmp 2452 311E.tmp 2724 31AB.tmp 2640 3237.tmp 2484 32B4.tmp 3020 32F2.tmp 1816 337F.tmp 2816 341B.tmp 2972 34A7.tmp 2976 3534.tmp 2060 35DF.tmp 1048 367B.tmp 284 36E8.tmp 2168 3775.tmp 320 3820.tmp 804 38BC.tmp 2708 3958.tmp 944 39C6.tmp 1032 3A14.tmp 860 3A62.tmp 1328 3AB0.tmp 2028 3AEE.tmp 1268 3B3C.tmp 2068 3B8A.tmp 2408 3BD8.tmp 2288 3C26.tmp 2052 3C74.tmp 2096 3CC2.tmp 1804 3D00.tmp 2008 3D4E.tmp 1124 3D9C.tmp 3036 3DEA.tmp 1140 3E38.tmp 2384 3E86.tmp 1556 3ED4.tmp 1964 3F22.tmp 1840 3F70.tmp 792 3FBE.tmp 2256 400C.tmp 1044 405A.tmp 1616 40A8.tmp 652 4106.tmp 3012 4154.tmp 3004 41A2.tmp 1020 41F0.tmp 2996 423E.tmp 1580 428C.tmp 2160 42DA.tmp 1940 4318.tmp 1576 4366.tmp 1600 43B4.tmp 1704 4402.tmp 2220 4441.tmp 2568 449E.tmp 2536 44DD.tmp 3064 452B.tmp 2572 4579.tmp 2560 45D6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2220 2188 2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe 28 PID 2188 wrote to memory of 2220 2188 2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe 28 PID 2220 wrote to memory of 2928 2220 2D76.tmp 29 PID 2220 wrote to memory of 2928 2220 2D76.tmp 29 PID 2220 wrote to memory of 2928 2220 2D76.tmp 29 PID 2220 wrote to memory of 2928 2220 2D76.tmp 29 PID 2928 wrote to memory of 2004 2928 2E12.tmp 30 PID 2928 wrote to memory of 2004 2928 2E12.tmp 30 PID 2928 wrote to memory of 2004 2928 2E12.tmp 30 PID 2928 wrote to memory of 2004 2928 2E12.tmp 30 PID 2004 wrote to memory of 2632 2004 2ECE.tmp 31 PID 2004 wrote to memory of 2632 2004 2ECE.tmp 31 PID 2004 wrote to memory of 2632 2004 2ECE.tmp 31 PID 2004 wrote to memory of 2632 2004 2ECE.tmp 31 PID 2632 wrote to memory of 2584 2632 2F2B.tmp 32 PID 2632 wrote to memory of 2584 2632 2F2B.tmp 32 PID 2632 wrote to memory of 2584 2632 2F2B.tmp 32 PID 2632 wrote to memory of 2584 2632 2F2B.tmp 32 PID 2584 wrote to memory of 2840 2584 2FC7.tmp 33 PID 2584 wrote to memory of 2840 2584 2FC7.tmp 33 PID 2584 wrote to memory of 2840 2584 2FC7.tmp 33 PID 2584 wrote to memory of 2840 2584 2FC7.tmp 33 PID 2840 wrote to memory of 2452 2840 3073.tmp 34 PID 2840 wrote to memory of 2452 2840 3073.tmp 34 PID 2840 wrote to memory of 2452 2840 3073.tmp 34 PID 2840 wrote to memory of 2452 2840 3073.tmp 34 PID 2452 wrote to memory of 2724 2452 311E.tmp 35 PID 2452 wrote to memory of 2724 2452 311E.tmp 35 PID 2452 wrote to memory of 2724 2452 311E.tmp 35 PID 2452 wrote to memory of 2724 2452 311E.tmp 35 PID 2724 wrote to memory of 2640 2724 31AB.tmp 36 PID 2724 wrote to memory of 2640 2724 31AB.tmp 36 PID 2724 wrote to memory of 2640 2724 31AB.tmp 36 PID 2724 wrote to memory of 2640 2724 31AB.tmp 36 PID 2640 wrote to memory of 2484 2640 3237.tmp 37 PID 2640 wrote to memory of 2484 2640 3237.tmp 37 PID 2640 wrote to memory of 2484 2640 3237.tmp 37 PID 2640 wrote to memory of 2484 2640 3237.tmp 37 PID 2484 wrote to memory of 3020 2484 32B4.tmp 38 PID 2484 wrote to memory of 3020 2484 32B4.tmp 38 PID 2484 wrote to memory of 3020 2484 32B4.tmp 38 PID 2484 wrote to memory of 3020 2484 32B4.tmp 38 PID 3020 wrote to memory of 1816 3020 32F2.tmp 39 PID 3020 wrote to memory of 1816 3020 32F2.tmp 39 PID 3020 wrote to memory of 1816 3020 32F2.tmp 39 PID 3020 wrote to memory of 1816 3020 32F2.tmp 39 PID 1816 wrote to memory of 2816 1816 337F.tmp 40 PID 1816 wrote to memory of 2816 1816 337F.tmp 40 PID 1816 wrote to memory of 2816 1816 337F.tmp 40 PID 1816 wrote to memory of 2816 1816 337F.tmp 40 PID 2816 wrote to memory of 2972 2816 341B.tmp 41 PID 2816 wrote to memory of 2972 2816 341B.tmp 41 PID 2816 wrote to memory of 2972 2816 341B.tmp 41 PID 2816 wrote to memory of 2972 2816 341B.tmp 41 PID 2972 wrote to memory of 2976 2972 34A7.tmp 42 PID 2972 wrote to memory of 2976 2972 34A7.tmp 42 PID 2972 wrote to memory of 2976 2972 34A7.tmp 42 PID 2972 wrote to memory of 2976 2972 34A7.tmp 42 PID 2976 wrote to memory of 2060 2976 3534.tmp 43 PID 2976 wrote to memory of 2060 2976 3534.tmp 43 PID 2976 wrote to memory of 2060 2976 3534.tmp 43 PID 2976 wrote to memory of 2060 2976 3534.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-01_f830b64849a4da17271b149880472af1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"65⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"66⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"67⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"68⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"70⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"73⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"74⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"75⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"76⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"77⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"78⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"79⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"80⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"81⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"82⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"83⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"84⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"85⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"86⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"87⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"88⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"89⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"91⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"92⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"93⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"94⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"95⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"96⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"97⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"98⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"99⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"100⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"101⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"102⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"103⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"104⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"105⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"106⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"107⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"109⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"110⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"111⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"112⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"113⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"114⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"115⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5503.tmp"C:\Users\Admin\AppData\Local\Temp\5503.tmp"116⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"117⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"118⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"119⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"120⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"121⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"122⤵PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-