Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe
-
Size
536KB
-
MD5
c1b18d6e9e006409792fe47ae99ad989
-
SHA1
2d18553a7b9c565f94d07a9b123c9b8eff4acf6f
-
SHA256
3d1ab361592ec8ac3b85938a54646c45df4826c60ed57f3938fed2ea285d9b7c
-
SHA512
3fc6c890a0a68830ec8fb4e6cd79cefbbbc13f94fdb80a130752befd0fb9fb875a3aa6b3b6c0addd4d1635456b1d85c7be61439b25db0ffdb8bb44f36b67f6ca
-
SSDEEP
12288:wU5rCOTeiUJ3WhdumnOOxw88hBuIZxVJ0ZT9:wUQOJUJ3WSbuIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 13BF.tmp 2560 140D.tmp 2660 148A.tmp 3008 1526.tmp 2724 15B2.tmp 2728 164E.tmp 2432 16DB.tmp 2956 1777.tmp 1964 17F4.tmp 2712 189F.tmp 2784 192C.tmp 2368 1999.tmp 2300 1A35.tmp 1876 1AA2.tmp 1356 1B1F.tmp 2372 1BAB.tmp 1240 1C38.tmp 2264 1CC4.tmp 1852 1D12.tmp 2404 1DAE.tmp 536 1E0C.tmp 328 1EA8.tmp 1572 1F15.tmp 528 1F72.tmp 1712 1FC0.tmp 1736 202E.tmp 3032 20AA.tmp 1436 2108.tmp 1476 2156.tmp 1556 21B4.tmp 2172 2211.tmp 936 225F.tmp 716 22CC.tmp 1972 232A.tmp 2176 2368.tmp 2004 23A7.tmp 1440 2414.tmp 2188 2452.tmp 3024 24A0.tmp 1660 24EE.tmp 2512 253C.tmp 2524 258A.tmp 2656 25D8.tmp 2576 2617.tmp 2536 2665.tmp 2732 26C2.tmp 2620 2701.tmp 2592 273F.tmp 2464 278D.tmp 2896 280A.tmp 1496 2858.tmp 2596 28A6.tmp 2772 28E4.tmp 2868 2923.tmp 1720 2971.tmp 2928 29BF.tmp 2304 2A0D.tmp 380 2A5B.tmp 1588 2A99.tmp 1788 2AD8.tmp 2396 2B16.tmp 344 2B54.tmp 332 2BA2.tmp 2244 2BE1.tmp -
Loads dropped DLL 64 IoCs
pid Process 2324 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 2748 13BF.tmp 2560 140D.tmp 2660 148A.tmp 3008 1526.tmp 2724 15B2.tmp 2728 164E.tmp 2432 16DB.tmp 2956 1777.tmp 1964 17F4.tmp 2712 189F.tmp 2784 192C.tmp 2368 1999.tmp 2300 1A35.tmp 1876 1AA2.tmp 1356 1B1F.tmp 2372 1BAB.tmp 1240 1C38.tmp 2264 1CC4.tmp 1852 1D12.tmp 2404 1DAE.tmp 536 1E0C.tmp 328 1EA8.tmp 1572 1F15.tmp 528 1F72.tmp 1712 1FC0.tmp 1736 202E.tmp 3032 20AA.tmp 1436 2108.tmp 1476 2156.tmp 1556 21B4.tmp 2172 2211.tmp 936 225F.tmp 716 22CC.tmp 1972 232A.tmp 2176 2368.tmp 2004 23A7.tmp 1440 2414.tmp 2188 2452.tmp 3024 24A0.tmp 1660 24EE.tmp 2512 253C.tmp 2524 258A.tmp 2656 25D8.tmp 2576 2617.tmp 2536 2665.tmp 2732 26C2.tmp 2620 2701.tmp 2592 273F.tmp 2464 278D.tmp 2896 280A.tmp 1496 2858.tmp 2596 28A6.tmp 2772 28E4.tmp 2868 2923.tmp 1720 2971.tmp 2928 29BF.tmp 2304 2A0D.tmp 380 2A5B.tmp 1588 2A99.tmp 1788 2AD8.tmp 2396 2B16.tmp 344 2B54.tmp 332 2BA2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2748 2324 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 28 PID 2324 wrote to memory of 2748 2324 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 28 PID 2324 wrote to memory of 2748 2324 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 28 PID 2324 wrote to memory of 2748 2324 2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe 28 PID 2748 wrote to memory of 2560 2748 13BF.tmp 29 PID 2748 wrote to memory of 2560 2748 13BF.tmp 29 PID 2748 wrote to memory of 2560 2748 13BF.tmp 29 PID 2748 wrote to memory of 2560 2748 13BF.tmp 29 PID 2560 wrote to memory of 2660 2560 140D.tmp 30 PID 2560 wrote to memory of 2660 2560 140D.tmp 30 PID 2560 wrote to memory of 2660 2560 140D.tmp 30 PID 2560 wrote to memory of 2660 2560 140D.tmp 30 PID 2660 wrote to memory of 3008 2660 148A.tmp 31 PID 2660 wrote to memory of 3008 2660 148A.tmp 31 PID 2660 wrote to memory of 3008 2660 148A.tmp 31 PID 2660 wrote to memory of 3008 2660 148A.tmp 31 PID 3008 wrote to memory of 2724 3008 1526.tmp 32 PID 3008 wrote to memory of 2724 3008 1526.tmp 32 PID 3008 wrote to memory of 2724 3008 1526.tmp 32 PID 3008 wrote to memory of 2724 3008 1526.tmp 32 PID 2724 wrote to memory of 2728 2724 15B2.tmp 33 PID 2724 wrote to memory of 2728 2724 15B2.tmp 33 PID 2724 wrote to memory of 2728 2724 15B2.tmp 33 PID 2724 wrote to memory of 2728 2724 15B2.tmp 33 PID 2728 wrote to memory of 2432 2728 164E.tmp 34 PID 2728 wrote to memory of 2432 2728 164E.tmp 34 PID 2728 wrote to memory of 2432 2728 164E.tmp 34 PID 2728 wrote to memory of 2432 2728 164E.tmp 34 PID 2432 wrote to memory of 2956 2432 16DB.tmp 35 PID 2432 wrote to memory of 2956 2432 16DB.tmp 35 PID 2432 wrote to memory of 2956 2432 16DB.tmp 35 PID 2432 wrote to memory of 2956 2432 16DB.tmp 35 PID 2956 wrote to memory of 1964 2956 1777.tmp 36 PID 2956 wrote to memory of 1964 2956 1777.tmp 36 PID 2956 wrote to memory of 1964 2956 1777.tmp 36 PID 2956 wrote to memory of 1964 2956 1777.tmp 36 PID 1964 wrote to memory of 2712 1964 17F4.tmp 37 PID 1964 wrote to memory of 2712 1964 17F4.tmp 37 PID 1964 wrote to memory of 2712 1964 17F4.tmp 37 PID 1964 wrote to memory of 2712 1964 17F4.tmp 37 PID 2712 wrote to memory of 2784 2712 189F.tmp 38 PID 2712 wrote to memory of 2784 2712 189F.tmp 38 PID 2712 wrote to memory of 2784 2712 189F.tmp 38 PID 2712 wrote to memory of 2784 2712 189F.tmp 38 PID 2784 wrote to memory of 2368 2784 192C.tmp 39 PID 2784 wrote to memory of 2368 2784 192C.tmp 39 PID 2784 wrote to memory of 2368 2784 192C.tmp 39 PID 2784 wrote to memory of 2368 2784 192C.tmp 39 PID 2368 wrote to memory of 2300 2368 1999.tmp 40 PID 2368 wrote to memory of 2300 2368 1999.tmp 40 PID 2368 wrote to memory of 2300 2368 1999.tmp 40 PID 2368 wrote to memory of 2300 2368 1999.tmp 40 PID 2300 wrote to memory of 1876 2300 1A35.tmp 41 PID 2300 wrote to memory of 1876 2300 1A35.tmp 41 PID 2300 wrote to memory of 1876 2300 1A35.tmp 41 PID 2300 wrote to memory of 1876 2300 1A35.tmp 41 PID 1876 wrote to memory of 1356 1876 1AA2.tmp 42 PID 1876 wrote to memory of 1356 1876 1AA2.tmp 42 PID 1876 wrote to memory of 1356 1876 1AA2.tmp 42 PID 1876 wrote to memory of 1356 1876 1AA2.tmp 42 PID 1356 wrote to memory of 2372 1356 1B1F.tmp 43 PID 1356 wrote to memory of 2372 1356 1B1F.tmp 43 PID 1356 wrote to memory of 2372 1356 1B1F.tmp 43 PID 1356 wrote to memory of 2372 1356 1B1F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_c1b18d6e9e006409792fe47ae99ad989_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"65⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"66⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"67⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"68⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"69⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"70⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"71⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"72⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"73⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"74⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"75⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"76⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"77⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"78⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"79⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"80⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"81⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"82⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"83⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"85⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"86⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"87⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"88⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"89⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"90⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"91⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"92⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"93⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"94⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"95⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"96⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"97⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"98⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"99⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"100⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"101⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"102⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"103⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"104⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"105⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"106⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"107⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"108⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"109⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"110⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"111⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"112⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"113⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"114⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"115⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"116⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"117⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"118⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"119⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"120⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"121⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"122⤵PID:1464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-