Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe
-
Size
487KB
-
MD5
3e039ed8791b4f5173be4634a9ddef20
-
SHA1
5881946737bbd1b07a58a9f02b622f2751e99dd9
-
SHA256
632f8a5a238750fa99dbe634838eac81708d51b4a1f18372cee67d9a2874cb9c
-
SHA512
81a6d8305559ac46c166e1f51b5efbb83c780530330e01d021f085630239b93bf43d629f56dd8e1c18f2e391275bf4651ea1ac198a69c3771be235fb0ede6179
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDx02p4zBKF5NDQwXgmxlPHZgKXgWPOU4mwubQ6:yU5rCOTeiN22p48FDxLxEij1wuUFgbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 75FB.tmp 1216 76E5.tmp 2148 77FD.tmp 2128 78E7.tmp 2480 79C2.tmp 2572 7AAC.tmp 2560 7B86.tmp 2448 7C9F.tmp 2556 7D5A.tmp 2500 7E63.tmp 2344 7F2E.tmp 2800 7FF9.tmp 1856 80E3.tmp 680 81DD.tmp 760 82B7.tmp 112 83C0.tmp 964 845C.tmp 1476 8556.tmp 536 8621.tmp 2032 872A.tmp 1940 8814.tmp 1368 88EE.tmp 1632 898A.tmp 1680 89D8.tmp 2164 8A45.tmp 884 8AA3.tmp 1112 8B01.tmp 2432 8B7D.tmp 2320 8C0A.tmp 2656 8C87.tmp 2132 8D03.tmp 2676 8D80.tmp 1276 8E0D.tmp 2668 8EE7.tmp 2600 8F54.tmp 436 8FC1.tmp 2996 904E.tmp 1816 90DA.tmp 1572 9167.tmp 1988 91D4.tmp 1208 9251.tmp 976 92CD.tmp 876 934A.tmp 1964 93D7.tmp 908 9463.tmp 2060 94FF.tmp 1676 95AB.tmp 3004 9637.tmp 1752 96B4.tmp 2296 9731.tmp 2824 97AD.tmp 1720 982A.tmp 1784 98C6.tmp 2092 9933.tmp 1612 99B0.tmp 1056 9A0E.tmp 2216 9A7B.tmp 2940 9B07.tmp 1216 9B65.tmp 3016 9BF1.tmp 2932 9C9D.tmp 2840 9D58.tmp 2524 9DC5.tmp 2544 9E42.tmp -
Loads dropped DLL 64 IoCs
pid Process 2808 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 2940 75FB.tmp 1216 76E5.tmp 2148 77FD.tmp 2128 78E7.tmp 2480 79C2.tmp 2572 7AAC.tmp 2560 7B86.tmp 2448 7C9F.tmp 2556 7D5A.tmp 2500 7E63.tmp 2344 7F2E.tmp 2800 7FF9.tmp 1856 80E3.tmp 680 81DD.tmp 760 82B7.tmp 112 83C0.tmp 964 845C.tmp 1476 8556.tmp 536 8621.tmp 2032 872A.tmp 1940 8814.tmp 1368 88EE.tmp 1632 898A.tmp 1680 89D8.tmp 2164 8A45.tmp 884 8AA3.tmp 1112 8B01.tmp 2432 8B7D.tmp 2320 8C0A.tmp 2656 8C87.tmp 2132 8D03.tmp 2676 8D80.tmp 1276 8E0D.tmp 2668 8EE7.tmp 2600 8F54.tmp 436 8FC1.tmp 2996 904E.tmp 1816 90DA.tmp 1572 9167.tmp 1988 91D4.tmp 1208 9251.tmp 976 92CD.tmp 876 934A.tmp 1964 93D7.tmp 908 9463.tmp 2060 94FF.tmp 1676 95AB.tmp 3004 9637.tmp 1752 96B4.tmp 2296 9731.tmp 2824 97AD.tmp 1720 982A.tmp 1784 98C6.tmp 2092 9933.tmp 1612 99B0.tmp 1056 9A0E.tmp 2216 9A7B.tmp 2940 9B07.tmp 1216 9B65.tmp 3016 9BF1.tmp 2932 9C9D.tmp 2840 9D58.tmp 2524 9DC5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2940 2808 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 28 PID 2808 wrote to memory of 2940 2808 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 28 PID 2808 wrote to memory of 2940 2808 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 28 PID 2808 wrote to memory of 2940 2808 2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe 28 PID 2940 wrote to memory of 1216 2940 75FB.tmp 29 PID 2940 wrote to memory of 1216 2940 75FB.tmp 29 PID 2940 wrote to memory of 1216 2940 75FB.tmp 29 PID 2940 wrote to memory of 1216 2940 75FB.tmp 29 PID 1216 wrote to memory of 2148 1216 76E5.tmp 30 PID 1216 wrote to memory of 2148 1216 76E5.tmp 30 PID 1216 wrote to memory of 2148 1216 76E5.tmp 30 PID 1216 wrote to memory of 2148 1216 76E5.tmp 30 PID 2148 wrote to memory of 2128 2148 77FD.tmp 31 PID 2148 wrote to memory of 2128 2148 77FD.tmp 31 PID 2148 wrote to memory of 2128 2148 77FD.tmp 31 PID 2148 wrote to memory of 2128 2148 77FD.tmp 31 PID 2128 wrote to memory of 2480 2128 78E7.tmp 32 PID 2128 wrote to memory of 2480 2128 78E7.tmp 32 PID 2128 wrote to memory of 2480 2128 78E7.tmp 32 PID 2128 wrote to memory of 2480 2128 78E7.tmp 32 PID 2480 wrote to memory of 2572 2480 79C2.tmp 33 PID 2480 wrote to memory of 2572 2480 79C2.tmp 33 PID 2480 wrote to memory of 2572 2480 79C2.tmp 33 PID 2480 wrote to memory of 2572 2480 79C2.tmp 33 PID 2572 wrote to memory of 2560 2572 7AAC.tmp 34 PID 2572 wrote to memory of 2560 2572 7AAC.tmp 34 PID 2572 wrote to memory of 2560 2572 7AAC.tmp 34 PID 2572 wrote to memory of 2560 2572 7AAC.tmp 34 PID 2560 wrote to memory of 2448 2560 7B86.tmp 35 PID 2560 wrote to memory of 2448 2560 7B86.tmp 35 PID 2560 wrote to memory of 2448 2560 7B86.tmp 35 PID 2560 wrote to memory of 2448 2560 7B86.tmp 35 PID 2448 wrote to memory of 2556 2448 7C9F.tmp 36 PID 2448 wrote to memory of 2556 2448 7C9F.tmp 36 PID 2448 wrote to memory of 2556 2448 7C9F.tmp 36 PID 2448 wrote to memory of 2556 2448 7C9F.tmp 36 PID 2556 wrote to memory of 2500 2556 7D5A.tmp 37 PID 2556 wrote to memory of 2500 2556 7D5A.tmp 37 PID 2556 wrote to memory of 2500 2556 7D5A.tmp 37 PID 2556 wrote to memory of 2500 2556 7D5A.tmp 37 PID 2500 wrote to memory of 2344 2500 7E63.tmp 38 PID 2500 wrote to memory of 2344 2500 7E63.tmp 38 PID 2500 wrote to memory of 2344 2500 7E63.tmp 38 PID 2500 wrote to memory of 2344 2500 7E63.tmp 38 PID 2344 wrote to memory of 2800 2344 7F2E.tmp 39 PID 2344 wrote to memory of 2800 2344 7F2E.tmp 39 PID 2344 wrote to memory of 2800 2344 7F2E.tmp 39 PID 2344 wrote to memory of 2800 2344 7F2E.tmp 39 PID 2800 wrote to memory of 1856 2800 7FF9.tmp 40 PID 2800 wrote to memory of 1856 2800 7FF9.tmp 40 PID 2800 wrote to memory of 1856 2800 7FF9.tmp 40 PID 2800 wrote to memory of 1856 2800 7FF9.tmp 40 PID 1856 wrote to memory of 680 1856 80E3.tmp 41 PID 1856 wrote to memory of 680 1856 80E3.tmp 41 PID 1856 wrote to memory of 680 1856 80E3.tmp 41 PID 1856 wrote to memory of 680 1856 80E3.tmp 41 PID 680 wrote to memory of 760 680 81DD.tmp 42 PID 680 wrote to memory of 760 680 81DD.tmp 42 PID 680 wrote to memory of 760 680 81DD.tmp 42 PID 680 wrote to memory of 760 680 81DD.tmp 42 PID 760 wrote to memory of 112 760 82B7.tmp 43 PID 760 wrote to memory of 112 760 82B7.tmp 43 PID 760 wrote to memory of 112 760 82B7.tmp 43 PID 760 wrote to memory of 112 760 82B7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-09_3e039ed8791b4f5173be4634a9ddef20_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9167.tmp"C:\Users\Admin\AppData\Local\Temp\9167.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\9731.tmp"C:\Users\Admin\AppData\Local\Temp\9731.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"65⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"66⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"67⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"68⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"69⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"70⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"71⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"72⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\A277.tmp"C:\Users\Admin\AppData\Local\Temp\A277.tmp"73⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"74⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"75⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"76⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"77⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"78⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"79⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"80⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"81⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"82⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"83⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"84⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"85⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"86⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"87⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"88⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"89⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"90⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"91⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"92⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"93⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"94⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"95⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"96⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"97⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"98⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"99⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"100⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"101⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"102⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"103⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"104⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"105⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"106⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"107⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"108⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"109⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"110⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"111⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"112⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"113⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"114⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"115⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"116⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"117⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"118⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"119⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"120⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"121⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"122⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-