Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe
-
Size
529KB
-
MD5
eff8285a17d12d196e6f57b637b30af8
-
SHA1
1ef444f006aff71675b44e1a798a435a01d5477b
-
SHA256
811cfadceb7401535be7193cea340bdb5aacbb210b95ade4cc150b2efb9bc555
-
SHA512
231e80acd14181a14bd63a56785dd65e72ef350b5a82a0d1e2c762e1fc1d591ca711ac9e0cb17886f1d0ab68405b7c542141337a06bb548fe91d4b23f54b0b33
-
SSDEEP
12288:NU5rCOTeijWvPVlq1Bv2LgyoaAiyKTZwlH4Hp:NUQOJjWvPy1F8bZ7TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2820 905D.tmp 2892 9119.tmp 2612 9186.tmp 2960 9203.tmp 2636 929F.tmp 2640 931B.tmp 2548 93A8.tmp 2724 9434.tmp 2752 94A1.tmp 2472 952E.tmp 2444 95E9.tmp 2856 9666.tmp 2880 96E3.tmp 1120 976F.tmp 1512 980B.tmp 2696 98B7.tmp 2616 9981.tmp 1212 9A2D.tmp 1648 9B17.tmp 1520 9BE2.tmp 2352 9CEB.tmp 2288 9D97.tmp 2012 9EA0.tmp 2000 9F2C.tmp 2348 9FA9.tmp 3032 A026.tmp 1628 A0A3.tmp 2132 A100.tmp 2128 A17D.tmp 2124 A1EA.tmp 776 A332.tmp 2804 A3AF.tmp 584 A41C.tmp 2608 A489.tmp 3044 A4F6.tmp 2944 A554.tmp 1720 A5C1.tmp 2044 A63E.tmp 1808 A68C.tmp 2036 A718.tmp 1828 A795.tmp 1840 A812.tmp 1372 A88F.tmp 3016 A91B.tmp 108 A988.tmp 948 AA05.tmp 2280 AA91.tmp 1340 AB1E.tmp 2052 AB8B.tmp 1676 ACD3.tmp 880 AD4F.tmp 2928 ADAD.tmp 3040 AE1A.tmp 2264 AE87.tmp 1584 AEF5.tmp 2832 AF52.tmp 2904 AFBF.tmp 3068 B07B.tmp 3028 B0F7.tmp 2552 B184.tmp 2164 B210.tmp 2644 B28D.tmp 2660 B30A.tmp 2996 B387.tmp -
Loads dropped DLL 64 IoCs
pid Process 2224 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 2820 905D.tmp 2892 9119.tmp 2612 9186.tmp 2960 9203.tmp 2636 929F.tmp 2640 931B.tmp 2548 93A8.tmp 2724 9434.tmp 2752 94A1.tmp 2472 952E.tmp 2444 95E9.tmp 2856 9666.tmp 2880 96E3.tmp 1120 976F.tmp 1512 980B.tmp 2696 98B7.tmp 2616 9981.tmp 1212 9A2D.tmp 1648 9B17.tmp 1520 9BE2.tmp 2352 9CEB.tmp 2288 9D97.tmp 2012 9EA0.tmp 2000 9F2C.tmp 2348 9FA9.tmp 3032 A026.tmp 1628 A0A3.tmp 2132 A100.tmp 2128 A17D.tmp 2124 A1EA.tmp 776 A332.tmp 2804 A3AF.tmp 584 A41C.tmp 2608 A489.tmp 3044 A4F6.tmp 2944 A554.tmp 1720 A5C1.tmp 2044 A63E.tmp 1808 A68C.tmp 2036 A718.tmp 1828 A795.tmp 1840 A812.tmp 1372 A88F.tmp 3016 A91B.tmp 108 A988.tmp 948 AA05.tmp 2280 AA91.tmp 1340 AB1E.tmp 2052 AB8B.tmp 1676 ACD3.tmp 880 AD4F.tmp 2928 ADAD.tmp 3040 AE1A.tmp 2264 AE87.tmp 1584 AEF5.tmp 2832 AF52.tmp 2904 AFBF.tmp 3068 B07B.tmp 3028 B0F7.tmp 2552 B184.tmp 2164 B210.tmp 2644 B28D.tmp 2660 B30A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2820 2224 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe 28 PID 2820 wrote to memory of 2892 2820 905D.tmp 29 PID 2820 wrote to memory of 2892 2820 905D.tmp 29 PID 2820 wrote to memory of 2892 2820 905D.tmp 29 PID 2820 wrote to memory of 2892 2820 905D.tmp 29 PID 2892 wrote to memory of 2612 2892 9119.tmp 30 PID 2892 wrote to memory of 2612 2892 9119.tmp 30 PID 2892 wrote to memory of 2612 2892 9119.tmp 30 PID 2892 wrote to memory of 2612 2892 9119.tmp 30 PID 2612 wrote to memory of 2960 2612 9186.tmp 31 PID 2612 wrote to memory of 2960 2612 9186.tmp 31 PID 2612 wrote to memory of 2960 2612 9186.tmp 31 PID 2612 wrote to memory of 2960 2612 9186.tmp 31 PID 2960 wrote to memory of 2636 2960 9203.tmp 32 PID 2960 wrote to memory of 2636 2960 9203.tmp 32 PID 2960 wrote to memory of 2636 2960 9203.tmp 32 PID 2960 wrote to memory of 2636 2960 9203.tmp 32 PID 2636 wrote to memory of 2640 2636 929F.tmp 33 PID 2636 wrote to memory of 2640 2636 929F.tmp 33 PID 2636 wrote to memory of 2640 2636 929F.tmp 33 PID 2636 wrote to memory of 2640 2636 929F.tmp 33 PID 2640 wrote to memory of 2548 2640 931B.tmp 34 PID 2640 wrote to memory of 2548 2640 931B.tmp 34 PID 2640 wrote to memory of 2548 2640 931B.tmp 34 PID 2640 wrote to memory of 2548 2640 931B.tmp 34 PID 2548 wrote to memory of 2724 2548 93A8.tmp 35 PID 2548 wrote to memory of 2724 2548 93A8.tmp 35 PID 2548 wrote to memory of 2724 2548 93A8.tmp 35 PID 2548 wrote to memory of 2724 2548 93A8.tmp 35 PID 2724 wrote to memory of 2752 2724 9434.tmp 36 PID 2724 wrote to memory of 2752 2724 9434.tmp 36 PID 2724 wrote to memory of 2752 2724 9434.tmp 36 PID 2724 wrote to memory of 2752 2724 9434.tmp 36 PID 2752 wrote to memory of 2472 2752 94A1.tmp 37 PID 2752 wrote to memory of 2472 2752 94A1.tmp 37 PID 2752 wrote to memory of 2472 2752 94A1.tmp 37 PID 2752 wrote to memory of 2472 2752 94A1.tmp 37 PID 2472 wrote to memory of 2444 2472 952E.tmp 38 PID 2472 wrote to memory of 2444 2472 952E.tmp 38 PID 2472 wrote to memory of 2444 2472 952E.tmp 38 PID 2472 wrote to memory of 2444 2472 952E.tmp 38 PID 2444 wrote to memory of 2856 2444 95E9.tmp 39 PID 2444 wrote to memory of 2856 2444 95E9.tmp 39 PID 2444 wrote to memory of 2856 2444 95E9.tmp 39 PID 2444 wrote to memory of 2856 2444 95E9.tmp 39 PID 2856 wrote to memory of 2880 2856 9666.tmp 40 PID 2856 wrote to memory of 2880 2856 9666.tmp 40 PID 2856 wrote to memory of 2880 2856 9666.tmp 40 PID 2856 wrote to memory of 2880 2856 9666.tmp 40 PID 2880 wrote to memory of 1120 2880 96E3.tmp 41 PID 2880 wrote to memory of 1120 2880 96E3.tmp 41 PID 2880 wrote to memory of 1120 2880 96E3.tmp 41 PID 2880 wrote to memory of 1120 2880 96E3.tmp 41 PID 1120 wrote to memory of 1512 1120 976F.tmp 42 PID 1120 wrote to memory of 1512 1120 976F.tmp 42 PID 1120 wrote to memory of 1512 1120 976F.tmp 42 PID 1120 wrote to memory of 1512 1120 976F.tmp 42 PID 1512 wrote to memory of 2696 1512 980B.tmp 43 PID 1512 wrote to memory of 2696 1512 980B.tmp 43 PID 1512 wrote to memory of 2696 1512 980B.tmp 43 PID 1512 wrote to memory of 2696 1512 980B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_eff8285a17d12d196e6f57b637b30af8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"65⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"66⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"67⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"68⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"70⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"71⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"73⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"74⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"75⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"76⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"77⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"78⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"79⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"80⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"82⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"83⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"84⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"85⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"86⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp"C:\Users\Admin\AppData\Local\Temp\BE50.tmp"87⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"88⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"89⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"90⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"91⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"92⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"93⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"94⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"95⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"96⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"97⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"98⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"99⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"100⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"101⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"102⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"103⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"104⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"105⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"106⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"107⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"108⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"109⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"110⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"111⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"112⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"113⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"114⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"115⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"116⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"117⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"118⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"119⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"120⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"121⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-