Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 13:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe
-
Size
486KB
-
MD5
9f2369455073c733c890fdbb588f76e4
-
SHA1
c8a5f138aaf6b907cd6afdc896c8be13045b2839
-
SHA256
c388b65cd042f9e81f7b64d8701ea3171f7180d574a19346b8fde62bc32bb5ae
-
SHA512
b5acda868413ba08b112926d6f0eb1379a5a0fc1b2b54007d986fdcd75ddf4f7e5c57405effdb8c604c7390512f50d7ad53b3d52b8dbe8e630110b7fbff1859a
-
SSDEEP
12288:UU5rCOTeiDxi5bwRlY4OOnigSoLBnpf5I3INZ:UUQOJDxWbgTn5ScBnpf5I4N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2100 F98B.tmp 2348 FA08.tmp 2336 FB02.tmp 2412 FBBD.tmp 2688 FC68.tmp 2820 FD14.tmp 2188 FDC0.tmp 2764 FE6B.tmp 2912 FF07.tmp 2712 FFA3.tmp 2548 3F.tmp 2660 CC.tmp 2400 168.tmp 1028 1E4.tmp 588 261.tmp 1108 2BF.tmp 1980 33C.tmp 1680 3C8.tmp 2316 454.tmp 264 4D1.tmp 540 55E.tmp 2992 5EA.tmp 2876 667.tmp 2212 6B5.tmp 2104 703.tmp 1228 751.tmp 1928 79F.tmp 2736 7ED.tmp 2720 83B.tmp 1160 889.tmp 1052 8D7.tmp 964 925.tmp 1540 973.tmp 268 9D0.tmp 656 A1E.tmp 2192 A6C.tmp 1092 ABA.tmp 1696 B08.tmp 2892 B56.tmp 2092 BB4.tmp 892 C02.tmp 2536 C60.tmp 2928 CAE.tmp 2236 CFC.tmp 1900 D78.tmp 1500 DD6.tmp 708 E14.tmp 1764 E62.tmp 1984 EB0.tmp 1796 EFE.tmp 2464 F4C.tmp 3048 F9A.tmp 1616 FE8.tmp 2620 1046.tmp 2100 1094.tmp 2448 10E2.tmp 2340 1140.tmp 2336 118E.tmp 2684 11EB.tmp 2792 1249.tmp 2696 12A6.tmp 2672 12F4.tmp 2148 1342.tmp 2824 1390.tmp -
Loads dropped DLL 64 IoCs
pid Process 3052 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 2100 F98B.tmp 2348 FA08.tmp 2336 FB02.tmp 2412 FBBD.tmp 2688 FC68.tmp 2820 FD14.tmp 2188 FDC0.tmp 2764 FE6B.tmp 2912 FF07.tmp 2712 FFA3.tmp 2548 3F.tmp 2660 CC.tmp 2400 168.tmp 1028 1E4.tmp 588 261.tmp 1108 2BF.tmp 1980 33C.tmp 1680 3C8.tmp 2316 454.tmp 264 4D1.tmp 540 55E.tmp 2992 5EA.tmp 2876 667.tmp 2212 6B5.tmp 2104 703.tmp 1228 751.tmp 1928 79F.tmp 2736 7ED.tmp 2720 83B.tmp 1160 889.tmp 1052 8D7.tmp 964 925.tmp 1540 973.tmp 268 9D0.tmp 656 A1E.tmp 2192 A6C.tmp 1092 ABA.tmp 1696 B08.tmp 2892 B56.tmp 2092 BB4.tmp 892 C02.tmp 2536 C60.tmp 2928 CAE.tmp 2236 CFC.tmp 1900 D78.tmp 1500 DD6.tmp 708 E14.tmp 1764 E62.tmp 1984 EB0.tmp 1796 EFE.tmp 2464 F4C.tmp 3048 F9A.tmp 1616 FE8.tmp 2620 1046.tmp 2100 1094.tmp 2448 10E2.tmp 2340 1140.tmp 2336 118E.tmp 2684 11EB.tmp 2792 1249.tmp 2696 12A6.tmp 2672 12F4.tmp 2148 1342.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2100 3052 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 30 PID 3052 wrote to memory of 2100 3052 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 30 PID 3052 wrote to memory of 2100 3052 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 30 PID 3052 wrote to memory of 2100 3052 2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe 30 PID 2100 wrote to memory of 2348 2100 F98B.tmp 31 PID 2100 wrote to memory of 2348 2100 F98B.tmp 31 PID 2100 wrote to memory of 2348 2100 F98B.tmp 31 PID 2100 wrote to memory of 2348 2100 F98B.tmp 31 PID 2348 wrote to memory of 2336 2348 FA08.tmp 32 PID 2348 wrote to memory of 2336 2348 FA08.tmp 32 PID 2348 wrote to memory of 2336 2348 FA08.tmp 32 PID 2348 wrote to memory of 2336 2348 FA08.tmp 32 PID 2336 wrote to memory of 2412 2336 FB02.tmp 33 PID 2336 wrote to memory of 2412 2336 FB02.tmp 33 PID 2336 wrote to memory of 2412 2336 FB02.tmp 33 PID 2336 wrote to memory of 2412 2336 FB02.tmp 33 PID 2412 wrote to memory of 2688 2412 FBBD.tmp 34 PID 2412 wrote to memory of 2688 2412 FBBD.tmp 34 PID 2412 wrote to memory of 2688 2412 FBBD.tmp 34 PID 2412 wrote to memory of 2688 2412 FBBD.tmp 34 PID 2688 wrote to memory of 2820 2688 FC68.tmp 35 PID 2688 wrote to memory of 2820 2688 FC68.tmp 35 PID 2688 wrote to memory of 2820 2688 FC68.tmp 35 PID 2688 wrote to memory of 2820 2688 FC68.tmp 35 PID 2820 wrote to memory of 2188 2820 FD14.tmp 36 PID 2820 wrote to memory of 2188 2820 FD14.tmp 36 PID 2820 wrote to memory of 2188 2820 FD14.tmp 36 PID 2820 wrote to memory of 2188 2820 FD14.tmp 36 PID 2188 wrote to memory of 2764 2188 FDC0.tmp 37 PID 2188 wrote to memory of 2764 2188 FDC0.tmp 37 PID 2188 wrote to memory of 2764 2188 FDC0.tmp 37 PID 2188 wrote to memory of 2764 2188 FDC0.tmp 37 PID 2764 wrote to memory of 2912 2764 FE6B.tmp 38 PID 2764 wrote to memory of 2912 2764 FE6B.tmp 38 PID 2764 wrote to memory of 2912 2764 FE6B.tmp 38 PID 2764 wrote to memory of 2912 2764 FE6B.tmp 38 PID 2912 wrote to memory of 2712 2912 FF07.tmp 39 PID 2912 wrote to memory of 2712 2912 FF07.tmp 39 PID 2912 wrote to memory of 2712 2912 FF07.tmp 39 PID 2912 wrote to memory of 2712 2912 FF07.tmp 39 PID 2712 wrote to memory of 2548 2712 FFA3.tmp 40 PID 2712 wrote to memory of 2548 2712 FFA3.tmp 40 PID 2712 wrote to memory of 2548 2712 FFA3.tmp 40 PID 2712 wrote to memory of 2548 2712 FFA3.tmp 40 PID 2548 wrote to memory of 2660 2548 3F.tmp 41 PID 2548 wrote to memory of 2660 2548 3F.tmp 41 PID 2548 wrote to memory of 2660 2548 3F.tmp 41 PID 2548 wrote to memory of 2660 2548 3F.tmp 41 PID 2660 wrote to memory of 2400 2660 CC.tmp 42 PID 2660 wrote to memory of 2400 2660 CC.tmp 42 PID 2660 wrote to memory of 2400 2660 CC.tmp 42 PID 2660 wrote to memory of 2400 2660 CC.tmp 42 PID 2400 wrote to memory of 1028 2400 168.tmp 43 PID 2400 wrote to memory of 1028 2400 168.tmp 43 PID 2400 wrote to memory of 1028 2400 168.tmp 43 PID 2400 wrote to memory of 1028 2400 168.tmp 43 PID 1028 wrote to memory of 588 1028 1E4.tmp 44 PID 1028 wrote to memory of 588 1028 1E4.tmp 44 PID 1028 wrote to memory of 588 1028 1E4.tmp 44 PID 1028 wrote to memory of 588 1028 1E4.tmp 44 PID 588 wrote to memory of 1108 588 261.tmp 45 PID 588 wrote to memory of 1108 588 261.tmp 45 PID 588 wrote to memory of 1108 588 261.tmp 45 PID 588 wrote to memory of 1108 588 261.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-08_9f2369455073c733c890fdbb588f76e4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1E4.tmp"C:\Users\Admin\AppData\Local\Temp\1E4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\2BF.tmp"C:\Users\Admin\AppData\Local\Temp\2BF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\33C.tmp"C:\Users\Admin\AppData\Local\Temp\33C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"66⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"67⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"68⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"69⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"70⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"71⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"72⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"73⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"74⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"75⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"76⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"77⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"78⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"79⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"80⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"81⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"82⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"83⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"84⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"85⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"86⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"88⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"89⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"90⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"91⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"92⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"93⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"94⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"95⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"96⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"97⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"98⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"99⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"100⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"101⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"102⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"103⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"104⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"105⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"106⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"107⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"108⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"109⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"110⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"111⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"112⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"113⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"114⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"115⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"116⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"117⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"118⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"119⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"121⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-