Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
-
Size
488KB
-
MD5
0bc52370976c4161e8f9bab9e6f0e03f
-
SHA1
a8b20ec7cfcf1019f426cd6a3dd5ffa9bdc140db
-
SHA256
1a859ffb81139d537b868bf0f1329e8955e49c31485d50792e4a4afb2d79f014
-
SHA512
bcfb701772c5e19397531cf04a7ec8d7fa98ef3cb66506018679a1288a36f4948e686d9053f4a637898a061ea6e3ae2d73d1a44a7dcb65556a4ce66263fbb828
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7vrS+bh31yhjFmLdMJ+iCtZFg0ZuODH/XUus6:/U5rCOTeiD9qko+iCa0/k1y+W0ZeNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1752 897B.tmp 2980 8A65.tmp 2624 8B9D.tmp 2620 8CA6.tmp 2644 8DAF.tmp 2724 8E7A.tmp 2452 8F45.tmp 2588 903E.tmp 2436 9147.tmp 2388 9203.tmp 2932 92DD.tmp 1264 93C7.tmp 1616 9463.tmp 1964 95CA.tmp 2760 96D3.tmp 2788 980B.tmp 2908 9914.tmp 1048 9A0E.tmp 1308 9AD9.tmp 1324 9C30.tmp 764 9CCC.tmp 1484 9D87.tmp 2716 9E52.tmp 1736 9ECF.tmp 1744 9F2C.tmp 1660 9FA9.tmp 2080 A016.tmp 2024 A074.tmp 1448 A0F1.tmp 2860 A19C.tmp 2316 A209.tmp 3032 A2A5.tmp 676 A322.tmp 2044 A3BE.tmp 2052 A45A.tmp 2084 A4D7.tmp 960 A544.tmp 1852 A5B1.tmp 1440 A61F.tmp 980 A6BB.tmp 828 A737.tmp 1796 A7C4.tmp 2168 A831.tmp 2156 A8AE.tmp 1088 A93A.tmp 560 A9C7.tmp 700 AA34.tmp 2508 AAC0.tmp 2188 AB3D.tmp 1044 ABD9.tmp 2740 AC56.tmp 888 ACD3.tmp 1596 AD4F.tmp 2916 ADDC.tmp 1572 AE59.tmp 1432 AEE5.tmp 2668 AF62.tmp 2356 AFDF.tmp 2616 B107.tmp 2628 B1B3.tmp 2528 B22F.tmp 2556 B2AC.tmp 2656 B30A.tmp 2676 B387.tmp -
Loads dropped DLL 64 IoCs
pid Process 1712 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 1752 897B.tmp 2980 8A65.tmp 2624 8B9D.tmp 2620 8CA6.tmp 2644 8DAF.tmp 2724 8E7A.tmp 2452 8F45.tmp 2588 903E.tmp 2436 9147.tmp 2388 9203.tmp 2932 92DD.tmp 1264 93C7.tmp 1616 9463.tmp 1964 95CA.tmp 2760 96D3.tmp 2788 980B.tmp 2908 9914.tmp 1048 9A0E.tmp 1308 9AD9.tmp 1324 9C30.tmp 764 9CCC.tmp 1484 9D87.tmp 2716 9E52.tmp 1736 9ECF.tmp 1744 9F2C.tmp 1660 9FA9.tmp 2080 A016.tmp 2024 A074.tmp 1448 A0F1.tmp 2860 A19C.tmp 2316 A209.tmp 3032 A2A5.tmp 676 A322.tmp 2044 A3BE.tmp 2052 A45A.tmp 2084 A4D7.tmp 960 A544.tmp 1852 A5B1.tmp 1440 A61F.tmp 980 A6BB.tmp 828 A737.tmp 1796 A7C4.tmp 2168 A831.tmp 2156 A8AE.tmp 1088 A93A.tmp 560 A9C7.tmp 700 AA34.tmp 2508 AAC0.tmp 2188 AB3D.tmp 1044 ABD9.tmp 2740 AC56.tmp 888 ACD3.tmp 1596 AD4F.tmp 2916 ADDC.tmp 1572 AE59.tmp 1432 AEE5.tmp 2668 AF62.tmp 2356 AFDF.tmp 2616 B107.tmp 2628 B1B3.tmp 2528 B22F.tmp 2556 B2AC.tmp 2656 B30A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1752 1712 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 28 PID 1712 wrote to memory of 1752 1712 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 28 PID 1712 wrote to memory of 1752 1712 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 28 PID 1712 wrote to memory of 1752 1712 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 28 PID 1752 wrote to memory of 2980 1752 897B.tmp 29 PID 1752 wrote to memory of 2980 1752 897B.tmp 29 PID 1752 wrote to memory of 2980 1752 897B.tmp 29 PID 1752 wrote to memory of 2980 1752 897B.tmp 29 PID 2980 wrote to memory of 2624 2980 8A65.tmp 30 PID 2980 wrote to memory of 2624 2980 8A65.tmp 30 PID 2980 wrote to memory of 2624 2980 8A65.tmp 30 PID 2980 wrote to memory of 2624 2980 8A65.tmp 30 PID 2624 wrote to memory of 2620 2624 8B9D.tmp 31 PID 2624 wrote to memory of 2620 2624 8B9D.tmp 31 PID 2624 wrote to memory of 2620 2624 8B9D.tmp 31 PID 2624 wrote to memory of 2620 2624 8B9D.tmp 31 PID 2620 wrote to memory of 2644 2620 8CA6.tmp 32 PID 2620 wrote to memory of 2644 2620 8CA6.tmp 32 PID 2620 wrote to memory of 2644 2620 8CA6.tmp 32 PID 2620 wrote to memory of 2644 2620 8CA6.tmp 32 PID 2644 wrote to memory of 2724 2644 8DAF.tmp 33 PID 2644 wrote to memory of 2724 2644 8DAF.tmp 33 PID 2644 wrote to memory of 2724 2644 8DAF.tmp 33 PID 2644 wrote to memory of 2724 2644 8DAF.tmp 33 PID 2724 wrote to memory of 2452 2724 8E7A.tmp 34 PID 2724 wrote to memory of 2452 2724 8E7A.tmp 34 PID 2724 wrote to memory of 2452 2724 8E7A.tmp 34 PID 2724 wrote to memory of 2452 2724 8E7A.tmp 34 PID 2452 wrote to memory of 2588 2452 8F45.tmp 35 PID 2452 wrote to memory of 2588 2452 8F45.tmp 35 PID 2452 wrote to memory of 2588 2452 8F45.tmp 35 PID 2452 wrote to memory of 2588 2452 8F45.tmp 35 PID 2588 wrote to memory of 2436 2588 903E.tmp 36 PID 2588 wrote to memory of 2436 2588 903E.tmp 36 PID 2588 wrote to memory of 2436 2588 903E.tmp 36 PID 2588 wrote to memory of 2436 2588 903E.tmp 36 PID 2436 wrote to memory of 2388 2436 9147.tmp 37 PID 2436 wrote to memory of 2388 2436 9147.tmp 37 PID 2436 wrote to memory of 2388 2436 9147.tmp 37 PID 2436 wrote to memory of 2388 2436 9147.tmp 37 PID 2388 wrote to memory of 2932 2388 9203.tmp 38 PID 2388 wrote to memory of 2932 2388 9203.tmp 38 PID 2388 wrote to memory of 2932 2388 9203.tmp 38 PID 2388 wrote to memory of 2932 2388 9203.tmp 38 PID 2932 wrote to memory of 1264 2932 92DD.tmp 39 PID 2932 wrote to memory of 1264 2932 92DD.tmp 39 PID 2932 wrote to memory of 1264 2932 92DD.tmp 39 PID 2932 wrote to memory of 1264 2932 92DD.tmp 39 PID 1264 wrote to memory of 1616 1264 93C7.tmp 40 PID 1264 wrote to memory of 1616 1264 93C7.tmp 40 PID 1264 wrote to memory of 1616 1264 93C7.tmp 40 PID 1264 wrote to memory of 1616 1264 93C7.tmp 40 PID 1616 wrote to memory of 1964 1616 9463.tmp 41 PID 1616 wrote to memory of 1964 1616 9463.tmp 41 PID 1616 wrote to memory of 1964 1616 9463.tmp 41 PID 1616 wrote to memory of 1964 1616 9463.tmp 41 PID 1964 wrote to memory of 2760 1964 95CA.tmp 42 PID 1964 wrote to memory of 2760 1964 95CA.tmp 42 PID 1964 wrote to memory of 2760 1964 95CA.tmp 42 PID 1964 wrote to memory of 2760 1964 95CA.tmp 42 PID 2760 wrote to memory of 2788 2760 96D3.tmp 43 PID 2760 wrote to memory of 2788 2760 96D3.tmp 43 PID 2760 wrote to memory of 2788 2760 96D3.tmp 43 PID 2760 wrote to memory of 2788 2760 96D3.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"C:\Users\Admin\AppData\Local\Temp\A9C7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"65⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"66⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"67⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"68⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"69⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"70⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"72⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"73⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"74⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"75⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"76⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"77⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"78⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"79⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"80⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"81⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"82⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"83⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"84⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"85⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"87⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"88⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"89⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"90⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"91⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"92⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"93⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"95⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"96⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"97⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"98⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"99⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"100⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"101⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"102⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"103⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"104⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"105⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"106⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"107⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"108⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"109⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"110⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"111⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"112⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"114⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"115⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"116⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"117⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"118⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"119⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"120⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"121⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"122⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-