Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe
-
Size
486KB
-
MD5
a7f67d7b0de71fd48f3bbb11849c0dde
-
SHA1
e3e6cf4c4ecb292508041cd24a847e9f83250e34
-
SHA256
0f517655cdd9f7dbbbeab927fd54b5c8a4cc83f343dcd83204cf430fbc92702d
-
SHA512
120e3e87243948a12d137e41c03502544c3d69cca9bc66cc58676c7b9267f0853f227c274f85a94b5f668c7a09a40adda32f1eb2ee41701ecf1305edbe4aee88
-
SSDEEP
12288:UU5rCOTeiD82xsXWe6DoupmeRIxZSj2uuhbAYNZ:UUQOJD8msm9iZc2MYN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1516 9147.tmp 2948 91F3.tmp 2472 932B.tmp 2616 9425.tmp 2516 94FF.tmp 2792 9608.tmp 2604 96D3.tmp 2404 977F.tmp 2416 983A.tmp 2384 9914.tmp 2876 99B0.tmp 1652 9A9A.tmp 1396 9B27.tmp 1372 9BF1.tmp 880 9CCC.tmp 2564 9D77.tmp 2720 9E42.tmp 2768 9F0D.tmp 2764 A007.tmp 1948 A100.tmp 1224 A1DB.tmp 2036 A38F.tmp 2576 A499.tmp 1784 A515.tmp 2240 A592.tmp 2244 A61F.tmp 1768 A69B.tmp 2068 A728.tmp 2304 A7A5.tmp 1716 A821.tmp 540 A89E.tmp 3016 A92B.tmp 2172 A9A7.tmp 1712 AA34.tmp 1064 AAB1.tmp 944 AB0E.tmp 1216 AB8B.tmp 1816 AC17.tmp 1552 ACA4.tmp 984 AD21.tmp 2000 ADAD.tmp 1672 AE49.tmp 2284 AEB6.tmp 2020 AF33.tmp 696 AFBF.tmp 3052 B05B.tmp 2076 B0D8.tmp 1676 B155.tmp 2132 B1D2.tmp 1648 B24F.tmp 1900 B2AC.tmp 2112 B329.tmp 2444 B396.tmp 1728 B413.tmp 2888 B49F.tmp 2248 B4FD.tmp 2552 B57A.tmp 2680 B5F7.tmp 3032 B664.tmp 2608 B6F0.tmp 2640 B75D.tmp 2808 B8C4.tmp 2616 B941.tmp 2652 B9BE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2888 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 1516 9147.tmp 2948 91F3.tmp 2472 932B.tmp 2616 9425.tmp 2516 94FF.tmp 2792 9608.tmp 2604 96D3.tmp 2404 977F.tmp 2416 983A.tmp 2384 9914.tmp 2876 99B0.tmp 1652 9A9A.tmp 1396 9B27.tmp 1372 9BF1.tmp 880 9CCC.tmp 2564 9D77.tmp 2720 9E42.tmp 2768 9F0D.tmp 2764 A007.tmp 1948 A100.tmp 1224 A1DB.tmp 2036 A38F.tmp 2576 A499.tmp 1784 A515.tmp 2240 A592.tmp 2244 A61F.tmp 1768 A69B.tmp 2068 A728.tmp 2304 A7A5.tmp 1716 A821.tmp 540 A89E.tmp 3016 A92B.tmp 2172 A9A7.tmp 1712 AA34.tmp 1064 AAB1.tmp 944 AB0E.tmp 1216 AB8B.tmp 1816 AC17.tmp 1552 ACA4.tmp 984 AD21.tmp 2000 ADAD.tmp 1672 AE49.tmp 2284 AEB6.tmp 2020 AF33.tmp 696 AFBF.tmp 3052 B05B.tmp 2076 B0D8.tmp 1676 B155.tmp 2132 B1D2.tmp 1648 B24F.tmp 1900 B2AC.tmp 2112 B329.tmp 2444 B396.tmp 1728 B413.tmp 2888 B49F.tmp 2248 B4FD.tmp 2552 B57A.tmp 2680 B5F7.tmp 3032 B664.tmp 2608 B6F0.tmp 2640 B75D.tmp 2808 B8C4.tmp 2616 B941.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 1516 2888 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 28 PID 2888 wrote to memory of 1516 2888 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 28 PID 2888 wrote to memory of 1516 2888 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 28 PID 2888 wrote to memory of 1516 2888 2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe 28 PID 1516 wrote to memory of 2948 1516 9147.tmp 29 PID 1516 wrote to memory of 2948 1516 9147.tmp 29 PID 1516 wrote to memory of 2948 1516 9147.tmp 29 PID 1516 wrote to memory of 2948 1516 9147.tmp 29 PID 2948 wrote to memory of 2472 2948 91F3.tmp 30 PID 2948 wrote to memory of 2472 2948 91F3.tmp 30 PID 2948 wrote to memory of 2472 2948 91F3.tmp 30 PID 2948 wrote to memory of 2472 2948 91F3.tmp 30 PID 2472 wrote to memory of 2616 2472 932B.tmp 31 PID 2472 wrote to memory of 2616 2472 932B.tmp 31 PID 2472 wrote to memory of 2616 2472 932B.tmp 31 PID 2472 wrote to memory of 2616 2472 932B.tmp 31 PID 2616 wrote to memory of 2516 2616 9425.tmp 32 PID 2616 wrote to memory of 2516 2616 9425.tmp 32 PID 2616 wrote to memory of 2516 2616 9425.tmp 32 PID 2616 wrote to memory of 2516 2616 9425.tmp 32 PID 2516 wrote to memory of 2792 2516 94FF.tmp 33 PID 2516 wrote to memory of 2792 2516 94FF.tmp 33 PID 2516 wrote to memory of 2792 2516 94FF.tmp 33 PID 2516 wrote to memory of 2792 2516 94FF.tmp 33 PID 2792 wrote to memory of 2604 2792 9608.tmp 34 PID 2792 wrote to memory of 2604 2792 9608.tmp 34 PID 2792 wrote to memory of 2604 2792 9608.tmp 34 PID 2792 wrote to memory of 2604 2792 9608.tmp 34 PID 2604 wrote to memory of 2404 2604 96D3.tmp 35 PID 2604 wrote to memory of 2404 2604 96D3.tmp 35 PID 2604 wrote to memory of 2404 2604 96D3.tmp 35 PID 2604 wrote to memory of 2404 2604 96D3.tmp 35 PID 2404 wrote to memory of 2416 2404 977F.tmp 36 PID 2404 wrote to memory of 2416 2404 977F.tmp 36 PID 2404 wrote to memory of 2416 2404 977F.tmp 36 PID 2404 wrote to memory of 2416 2404 977F.tmp 36 PID 2416 wrote to memory of 2384 2416 983A.tmp 37 PID 2416 wrote to memory of 2384 2416 983A.tmp 37 PID 2416 wrote to memory of 2384 2416 983A.tmp 37 PID 2416 wrote to memory of 2384 2416 983A.tmp 37 PID 2384 wrote to memory of 2876 2384 9914.tmp 38 PID 2384 wrote to memory of 2876 2384 9914.tmp 38 PID 2384 wrote to memory of 2876 2384 9914.tmp 38 PID 2384 wrote to memory of 2876 2384 9914.tmp 38 PID 2876 wrote to memory of 1652 2876 99B0.tmp 39 PID 2876 wrote to memory of 1652 2876 99B0.tmp 39 PID 2876 wrote to memory of 1652 2876 99B0.tmp 39 PID 2876 wrote to memory of 1652 2876 99B0.tmp 39 PID 1652 wrote to memory of 1396 1652 9A9A.tmp 40 PID 1652 wrote to memory of 1396 1652 9A9A.tmp 40 PID 1652 wrote to memory of 1396 1652 9A9A.tmp 40 PID 1652 wrote to memory of 1396 1652 9A9A.tmp 40 PID 1396 wrote to memory of 1372 1396 9B27.tmp 41 PID 1396 wrote to memory of 1372 1396 9B27.tmp 41 PID 1396 wrote to memory of 1372 1396 9B27.tmp 41 PID 1396 wrote to memory of 1372 1396 9B27.tmp 41 PID 1372 wrote to memory of 880 1372 9BF1.tmp 42 PID 1372 wrote to memory of 880 1372 9BF1.tmp 42 PID 1372 wrote to memory of 880 1372 9BF1.tmp 42 PID 1372 wrote to memory of 880 1372 9BF1.tmp 42 PID 880 wrote to memory of 2564 880 9CCC.tmp 43 PID 880 wrote to memory of 2564 880 9CCC.tmp 43 PID 880 wrote to memory of 2564 880 9CCC.tmp 43 PID 880 wrote to memory of 2564 880 9CCC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_a7f67d7b0de71fd48f3bbb11849c0dde_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\977F.tmp"C:\Users\Admin\AppData\Local\Temp\977F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\9D77.tmp"C:\Users\Admin\AppData\Local\Temp\9D77.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"65⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"66⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"67⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"68⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"70⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"72⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"73⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"74⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"75⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"76⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"77⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"78⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"79⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"80⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"81⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"82⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"83⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"84⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"85⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"86⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"87⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C468.tmp"C:\Users\Admin\AppData\Local\Temp\C468.tmp"88⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"89⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"91⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"92⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"93⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"94⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"95⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"96⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"97⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"98⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"99⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"100⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"101⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"102⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"103⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"104⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"105⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"106⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"108⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"109⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"110⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"111⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"113⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"114⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"115⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"116⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"117⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"118⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"119⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"120⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"121⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-