Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/04/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
-
Size
530KB
-
MD5
242dc2d0a656d4c688bc64a24e52e962
-
SHA1
0ba31afdfa0d7dbd9c21ea42fd82084cae9906cf
-
SHA256
6b23ce9b5a1e3ebe3553819035aa81c0e26c70c6c5659050e320bf412e3f6fe5
-
SHA512
df1b73f79206820034a0a476e4582684f97f055d5f12c136c9b77ca63cdda4683b36307f036dd8fbec2ef5ec81d9e16409831fe1a55eb5ebf21886a18545e942
-
SSDEEP
12288:AU5rCOTeiougJA8iw2DftJIC6FnKIsNZulFVg0M1:AUQOJouo+XtJUKIsNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2760 8852.tmp 2516 88A0.tmp 2572 893C.tmp 2696 89C9.tmp 2548 8A55.tmp 2540 8AE1.tmp 2512 8B6E.tmp 2692 8C0A.tmp 2424 8C87.tmp 2488 8D13.tmp 2736 8DFD.tmp 1004 8E89.tmp 1552 8F35.tmp 1400 8FE1.tmp 1860 906D.tmp 904 9147.tmp 2712 91F3.tmp 1276 928F.tmp 1036 933B.tmp 2216 9398.tmp 840 9453.tmp 2136 94FF.tmp 2220 95AB.tmp 1724 9647.tmp 1532 9721.tmp 1624 97DC.tmp 832 9878.tmp 2096 98F5.tmp 1444 9962.tmp 2168 9B17.tmp 2796 9BF1.tmp 3032 9C5F.tmp 528 9CCC.tmp 1412 9D39.tmp 2036 9DB6.tmp 2172 9E13.tmp 2024 9E71.tmp 1384 9EDE.tmp 1696 9F4B.tmp 968 9FB9.tmp 2240 A035.tmp 1500 A0C2.tmp 1660 A13F.tmp 1800 A19C.tmp 880 A209.tmp 712 A267.tmp 2176 A2D4.tmp 2328 A332.tmp 3048 A3ED.tmp 1008 A45A.tmp 1136 A4E7.tmp 1592 A5A2.tmp 1964 A60F.tmp 2296 A68C.tmp 1588 A757.tmp 2508 A7F3.tmp 2308 A89E.tmp 2532 A93A.tmp 2668 A9D6.tmp 2724 AA53.tmp 2608 AAD0.tmp 2972 AB3D.tmp 2504 ABBA.tmp 2856 AC56.tmp -
Loads dropped DLL 64 IoCs
pid Process 1760 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 2760 8852.tmp 2516 88A0.tmp 2572 893C.tmp 2696 89C9.tmp 2548 8A55.tmp 2540 8AE1.tmp 2512 8B6E.tmp 2692 8C0A.tmp 2424 8C87.tmp 2488 8D13.tmp 2736 8DFD.tmp 1004 8E89.tmp 1552 8F35.tmp 1400 8FE1.tmp 1860 906D.tmp 904 9147.tmp 2712 91F3.tmp 1276 928F.tmp 1036 933B.tmp 2216 9398.tmp 840 9453.tmp 2136 94FF.tmp 2220 95AB.tmp 1724 9647.tmp 1532 9721.tmp 1624 97DC.tmp 832 9878.tmp 2096 98F5.tmp 1444 9962.tmp 2168 9B17.tmp 2796 9BF1.tmp 3032 9C5F.tmp 528 9CCC.tmp 1412 9D39.tmp 2036 9DB6.tmp 2172 9E13.tmp 2024 9E71.tmp 1384 9EDE.tmp 1696 9F4B.tmp 968 9FB9.tmp 2240 A035.tmp 1500 A0C2.tmp 1660 A13F.tmp 1800 A19C.tmp 880 A209.tmp 712 A267.tmp 2176 A2D4.tmp 2328 A332.tmp 3048 A3ED.tmp 1008 A45A.tmp 1136 A4E7.tmp 1592 A5A2.tmp 1964 A60F.tmp 2296 A68C.tmp 1588 A757.tmp 2508 A7F3.tmp 2308 A89E.tmp 2532 A93A.tmp 2668 A9D6.tmp 2724 AA53.tmp 2608 AAD0.tmp 2972 AB3D.tmp 2504 ABBA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2760 1760 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 28 PID 2760 wrote to memory of 2516 2760 8852.tmp 29 PID 2760 wrote to memory of 2516 2760 8852.tmp 29 PID 2760 wrote to memory of 2516 2760 8852.tmp 29 PID 2760 wrote to memory of 2516 2760 8852.tmp 29 PID 2516 wrote to memory of 2572 2516 88A0.tmp 30 PID 2516 wrote to memory of 2572 2516 88A0.tmp 30 PID 2516 wrote to memory of 2572 2516 88A0.tmp 30 PID 2516 wrote to memory of 2572 2516 88A0.tmp 30 PID 2572 wrote to memory of 2696 2572 893C.tmp 31 PID 2572 wrote to memory of 2696 2572 893C.tmp 31 PID 2572 wrote to memory of 2696 2572 893C.tmp 31 PID 2572 wrote to memory of 2696 2572 893C.tmp 31 PID 2696 wrote to memory of 2548 2696 89C9.tmp 32 PID 2696 wrote to memory of 2548 2696 89C9.tmp 32 PID 2696 wrote to memory of 2548 2696 89C9.tmp 32 PID 2696 wrote to memory of 2548 2696 89C9.tmp 32 PID 2548 wrote to memory of 2540 2548 8A55.tmp 33 PID 2548 wrote to memory of 2540 2548 8A55.tmp 33 PID 2548 wrote to memory of 2540 2548 8A55.tmp 33 PID 2548 wrote to memory of 2540 2548 8A55.tmp 33 PID 2540 wrote to memory of 2512 2540 8AE1.tmp 34 PID 2540 wrote to memory of 2512 2540 8AE1.tmp 34 PID 2540 wrote to memory of 2512 2540 8AE1.tmp 34 PID 2540 wrote to memory of 2512 2540 8AE1.tmp 34 PID 2512 wrote to memory of 2692 2512 8B6E.tmp 35 PID 2512 wrote to memory of 2692 2512 8B6E.tmp 35 PID 2512 wrote to memory of 2692 2512 8B6E.tmp 35 PID 2512 wrote to memory of 2692 2512 8B6E.tmp 35 PID 2692 wrote to memory of 2424 2692 8C0A.tmp 36 PID 2692 wrote to memory of 2424 2692 8C0A.tmp 36 PID 2692 wrote to memory of 2424 2692 8C0A.tmp 36 PID 2692 wrote to memory of 2424 2692 8C0A.tmp 36 PID 2424 wrote to memory of 2488 2424 8C87.tmp 37 PID 2424 wrote to memory of 2488 2424 8C87.tmp 37 PID 2424 wrote to memory of 2488 2424 8C87.tmp 37 PID 2424 wrote to memory of 2488 2424 8C87.tmp 37 PID 2488 wrote to memory of 2736 2488 8D13.tmp 38 PID 2488 wrote to memory of 2736 2488 8D13.tmp 38 PID 2488 wrote to memory of 2736 2488 8D13.tmp 38 PID 2488 wrote to memory of 2736 2488 8D13.tmp 38 PID 2736 wrote to memory of 1004 2736 8DFD.tmp 39 PID 2736 wrote to memory of 1004 2736 8DFD.tmp 39 PID 2736 wrote to memory of 1004 2736 8DFD.tmp 39 PID 2736 wrote to memory of 1004 2736 8DFD.tmp 39 PID 1004 wrote to memory of 1552 1004 8E89.tmp 40 PID 1004 wrote to memory of 1552 1004 8E89.tmp 40 PID 1004 wrote to memory of 1552 1004 8E89.tmp 40 PID 1004 wrote to memory of 1552 1004 8E89.tmp 40 PID 1552 wrote to memory of 1400 1552 8F35.tmp 41 PID 1552 wrote to memory of 1400 1552 8F35.tmp 41 PID 1552 wrote to memory of 1400 1552 8F35.tmp 41 PID 1552 wrote to memory of 1400 1552 8F35.tmp 41 PID 1400 wrote to memory of 1860 1400 8FE1.tmp 42 PID 1400 wrote to memory of 1860 1400 8FE1.tmp 42 PID 1400 wrote to memory of 1860 1400 8FE1.tmp 42 PID 1400 wrote to memory of 1860 1400 8FE1.tmp 42 PID 1860 wrote to memory of 904 1860 906D.tmp 43 PID 1860 wrote to memory of 904 1860 906D.tmp 43 PID 1860 wrote to memory of 904 1860 906D.tmp 43 PID 1860 wrote to memory of 904 1860 906D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\933B.tmp"C:\Users\Admin\AppData\Local\Temp\933B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\A035.tmp"C:\Users\Admin\AppData\Local\Temp\A035.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"65⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"66⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"67⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"68⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"69⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"70⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"71⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"72⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"73⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"74⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"75⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"76⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"77⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"78⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"79⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"80⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"82⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"83⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"84⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"85⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"86⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"87⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"88⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"89⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"90⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"91⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"92⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"93⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"94⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"95⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"96⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"97⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"98⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"99⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"100⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"101⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"102⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"103⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"104⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"105⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"106⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"107⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"108⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"109⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"110⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"111⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"112⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"113⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"114⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"115⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"116⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"117⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"118⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"120⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"121⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-