Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe
-
Size
486KB
-
MD5
4dc49241dd6a923c5c31b33de2c7b4cb
-
SHA1
102668c75b53c2abc77b96ed063801a1f50e35fb
-
SHA256
ad75ea2bfb70ba5f41fd61b5b406f76293c52111c1898bbcf5c3582cf4647d72
-
SHA512
231898a72b71f0bda00962c63371e31d0e9d34d032fb7cc2f60ad06395812035d741ba9df966e81147df0e07f4e3b209ca8f7bf0f72357d94df023f638f62e3b
-
SSDEEP
12288:/U5rCOTeiDXyvbjdBN4ZvZ7Cm1U4GuJ1:/UQOJDMnNCvzUAJ1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1432 897B.tmp 1456 8A45.tmp 2616 8B6E.tmp 2576 8C77.tmp 2676 8D32.tmp 2540 8E3B.tmp 2452 8F35.tmp 2588 9000.tmp 2436 90BB.tmp 2388 91C4.tmp 2932 929F.tmp 1264 9379.tmp 1616 9444.tmp 1956 953D.tmp 2736 9627.tmp 2816 96F2.tmp 2832 97CD.tmp 2136 9888.tmp 1308 99B0.tmp 1996 9A7B.tmp 764 9C9D.tmp 1484 9D58.tmp 2716 9E52.tmp 1736 9EDE.tmp 1744 9F4B.tmp 1660 9FD8.tmp 2080 A064.tmp 2024 A100.tmp 1448 A17D.tmp 2860 A219.tmp 2316 A2A5.tmp 3032 A322.tmp 380 A3AF.tmp 2044 A43B.tmp 2052 A4C7.tmp 2084 A563.tmp 960 A5F0.tmp 1852 A66D.tmp 1440 A6F9.tmp 980 A785.tmp 828 A802.tmp 1756 A88F.tmp 2176 A90B.tmp 2156 A988.tmp 1088 AA05.tmp 560 AA91.tmp 700 AB0E.tmp 2856 AB9B.tmp 1612 AC17.tmp 1044 ACB3.tmp 588 AD4F.tmp 1632 ADDC.tmp 2064 AE59.tmp 2916 AED5.tmp 1572 AF52.tmp 1936 AFEE.tmp 2356 B193.tmp 3064 B22F.tmp 2568 B2AC.tmp 2620 B329.tmp 2548 B3A6.tmp 2684 B442.tmp 2096 B4AF.tmp 2460 B53B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2216 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 1432 897B.tmp 1456 8A45.tmp 2616 8B6E.tmp 2576 8C77.tmp 2676 8D32.tmp 2540 8E3B.tmp 2452 8F35.tmp 2588 9000.tmp 2436 90BB.tmp 2388 91C4.tmp 2932 929F.tmp 1264 9379.tmp 1616 9444.tmp 1956 953D.tmp 2736 9627.tmp 2816 96F2.tmp 2832 97CD.tmp 2136 9888.tmp 1308 99B0.tmp 1996 9A7B.tmp 764 9C9D.tmp 1484 9D58.tmp 2716 9E52.tmp 1736 9EDE.tmp 1744 9F4B.tmp 1660 9FD8.tmp 2080 A064.tmp 2024 A100.tmp 1448 A17D.tmp 2860 A219.tmp 2316 A2A5.tmp 3032 A322.tmp 380 A3AF.tmp 2044 A43B.tmp 2052 A4C7.tmp 2084 A563.tmp 960 A5F0.tmp 1852 A66D.tmp 1440 A6F9.tmp 980 A785.tmp 828 A802.tmp 1756 A88F.tmp 2176 A90B.tmp 2156 A988.tmp 1088 AA05.tmp 560 AA91.tmp 700 AB0E.tmp 2856 AB9B.tmp 1612 AC17.tmp 1044 ACB3.tmp 588 AD4F.tmp 1632 ADDC.tmp 2064 AE59.tmp 2916 AED5.tmp 1572 AF52.tmp 1936 AFEE.tmp 2356 B193.tmp 3064 B22F.tmp 2568 B2AC.tmp 2620 B329.tmp 2548 B3A6.tmp 2684 B442.tmp 2096 B4AF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1432 2216 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 28 PID 2216 wrote to memory of 1432 2216 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 28 PID 2216 wrote to memory of 1432 2216 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 28 PID 2216 wrote to memory of 1432 2216 2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe 28 PID 1432 wrote to memory of 1456 1432 897B.tmp 29 PID 1432 wrote to memory of 1456 1432 897B.tmp 29 PID 1432 wrote to memory of 1456 1432 897B.tmp 29 PID 1432 wrote to memory of 1456 1432 897B.tmp 29 PID 1456 wrote to memory of 2616 1456 8A45.tmp 30 PID 1456 wrote to memory of 2616 1456 8A45.tmp 30 PID 1456 wrote to memory of 2616 1456 8A45.tmp 30 PID 1456 wrote to memory of 2616 1456 8A45.tmp 30 PID 2616 wrote to memory of 2576 2616 8B6E.tmp 31 PID 2616 wrote to memory of 2576 2616 8B6E.tmp 31 PID 2616 wrote to memory of 2576 2616 8B6E.tmp 31 PID 2616 wrote to memory of 2576 2616 8B6E.tmp 31 PID 2576 wrote to memory of 2676 2576 8C77.tmp 32 PID 2576 wrote to memory of 2676 2576 8C77.tmp 32 PID 2576 wrote to memory of 2676 2576 8C77.tmp 32 PID 2576 wrote to memory of 2676 2576 8C77.tmp 32 PID 2676 wrote to memory of 2540 2676 8D32.tmp 33 PID 2676 wrote to memory of 2540 2676 8D32.tmp 33 PID 2676 wrote to memory of 2540 2676 8D32.tmp 33 PID 2676 wrote to memory of 2540 2676 8D32.tmp 33 PID 2540 wrote to memory of 2452 2540 8E3B.tmp 34 PID 2540 wrote to memory of 2452 2540 8E3B.tmp 34 PID 2540 wrote to memory of 2452 2540 8E3B.tmp 34 PID 2540 wrote to memory of 2452 2540 8E3B.tmp 34 PID 2452 wrote to memory of 2588 2452 8F35.tmp 35 PID 2452 wrote to memory of 2588 2452 8F35.tmp 35 PID 2452 wrote to memory of 2588 2452 8F35.tmp 35 PID 2452 wrote to memory of 2588 2452 8F35.tmp 35 PID 2588 wrote to memory of 2436 2588 9000.tmp 36 PID 2588 wrote to memory of 2436 2588 9000.tmp 36 PID 2588 wrote to memory of 2436 2588 9000.tmp 36 PID 2588 wrote to memory of 2436 2588 9000.tmp 36 PID 2436 wrote to memory of 2388 2436 90BB.tmp 37 PID 2436 wrote to memory of 2388 2436 90BB.tmp 37 PID 2436 wrote to memory of 2388 2436 90BB.tmp 37 PID 2436 wrote to memory of 2388 2436 90BB.tmp 37 PID 2388 wrote to memory of 2932 2388 91C4.tmp 38 PID 2388 wrote to memory of 2932 2388 91C4.tmp 38 PID 2388 wrote to memory of 2932 2388 91C4.tmp 38 PID 2388 wrote to memory of 2932 2388 91C4.tmp 38 PID 2932 wrote to memory of 1264 2932 929F.tmp 39 PID 2932 wrote to memory of 1264 2932 929F.tmp 39 PID 2932 wrote to memory of 1264 2932 929F.tmp 39 PID 2932 wrote to memory of 1264 2932 929F.tmp 39 PID 1264 wrote to memory of 1616 1264 9379.tmp 40 PID 1264 wrote to memory of 1616 1264 9379.tmp 40 PID 1264 wrote to memory of 1616 1264 9379.tmp 40 PID 1264 wrote to memory of 1616 1264 9379.tmp 40 PID 1616 wrote to memory of 1956 1616 9444.tmp 41 PID 1616 wrote to memory of 1956 1616 9444.tmp 41 PID 1616 wrote to memory of 1956 1616 9444.tmp 41 PID 1616 wrote to memory of 1956 1616 9444.tmp 41 PID 1956 wrote to memory of 2736 1956 953D.tmp 42 PID 1956 wrote to memory of 2736 1956 953D.tmp 42 PID 1956 wrote to memory of 2736 1956 953D.tmp 42 PID 1956 wrote to memory of 2736 1956 953D.tmp 42 PID 2736 wrote to memory of 2816 2736 9627.tmp 43 PID 2736 wrote to memory of 2816 2736 9627.tmp 43 PID 2736 wrote to memory of 2816 2736 9627.tmp 43 PID 2736 wrote to memory of 2816 2736 9627.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_4dc49241dd6a923c5c31b33de2c7b4cb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\9888.tmp"C:\Users\Admin\AppData\Local\Temp\9888.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"65⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"66⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"68⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"69⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"70⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"72⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"73⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"74⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"75⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"76⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"C:\Users\Admin\AppData\Local\Temp\BBE0.tmp"77⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"79⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"80⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"81⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"82⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"83⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"84⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"85⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"86⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"87⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"88⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"89⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"90⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"91⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"92⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"93⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"94⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"95⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"96⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"97⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"98⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"99⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"100⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"101⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"102⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"103⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"104⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"105⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"106⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"107⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"108⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"109⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"110⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"111⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"112⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"114⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"115⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"116⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"117⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\D21E.tmp"C:\Users\Admin\AppData\Local\Temp\D21E.tmp"120⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\D29B.tmp"C:\Users\Admin\AppData\Local\Temp\D29B.tmp"121⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-