Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe
-
Size
486KB
-
MD5
a55ee48c98c13b4bc83fe99e428f1259
-
SHA1
31b9ee53b4fd74f15f85ee115ab0580a7ba60508
-
SHA256
a5e5246b6fa4e7023228f353ef03f28b01b4e68ef3cb8e362bf302a139f110ac
-
SHA512
469cef8a48b168406fa7a2f2e9301f27cb8f1f6d882e0b97be990137702bbabdacb79f541976a7b434085fb259522be0258a4c3ca377d7b9dd561a429d6a4322
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7dcOex0XC5xhs+mZP0/HN8p+HHlFhxpKPDl4s:UU5rCOTeiDd7dXC5k+06oiHNmuouINZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 27CC.tmp 3068 2839.tmp 2684 28B6.tmp 2632 2923.tmp 2744 2961.tmp 2504 29BF.tmp 2612 2A0D.tmp 2472 2A6A.tmp 2596 2AC8.tmp 2648 2B35.tmp 324 2BA2.tmp 1544 2C10.tmp 2780 2C8C.tmp 1736 2CEA.tmp 2180 2D67.tmp 2184 2DD4.tmp 1568 2E41.tmp 1556 2EAE.tmp 2360 2F1C.tmp 668 2F89.tmp 1840 2FF6.tmp 1248 3063.tmp 2324 30C1.tmp 2120 30FF.tmp 2436 313E.tmp 1184 317C.tmp 2284 31BA.tmp 2860 31F9.tmp 2240 3247.tmp 1076 3285.tmp 1400 32C4.tmp 1612 3302.tmp 2108 3340.tmp 1120 337F.tmp 908 33BD.tmp 2332 33FC.tmp 1180 343A.tmp 3060 3478.tmp 1848 34B7.tmp 1072 34F5.tmp 1692 3534.tmp 1300 3572.tmp 1572 35B0.tmp 2016 35EF.tmp 852 362D.tmp 2984 366C.tmp 1920 36AA.tmp 1724 36E8.tmp 1856 3727.tmp 2852 3765.tmp 1108 37B3.tmp 2344 37F2.tmp 892 3830.tmp 2188 386E.tmp 2088 38AD.tmp 1500 38FB.tmp 2308 3939.tmp 2084 3978.tmp 2940 39B6.tmp 2696 39F4.tmp 2692 3A42.tmp 2676 3A90.tmp 1212 3AEE.tmp 2592 3B2C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2400 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 2940 27CC.tmp 3068 2839.tmp 2684 28B6.tmp 2632 2923.tmp 2744 2961.tmp 2504 29BF.tmp 2612 2A0D.tmp 2472 2A6A.tmp 2596 2AC8.tmp 2648 2B35.tmp 324 2BA2.tmp 1544 2C10.tmp 2780 2C8C.tmp 1736 2CEA.tmp 2180 2D67.tmp 2184 2DD4.tmp 1568 2E41.tmp 1556 2EAE.tmp 2360 2F1C.tmp 668 2F89.tmp 1840 2FF6.tmp 1248 3063.tmp 2324 30C1.tmp 2120 30FF.tmp 2436 313E.tmp 1184 317C.tmp 2284 31BA.tmp 2860 31F9.tmp 2240 3247.tmp 1076 3285.tmp 1400 32C4.tmp 1612 3302.tmp 2108 3340.tmp 1120 337F.tmp 908 33BD.tmp 2332 33FC.tmp 1180 343A.tmp 3060 3478.tmp 1848 34B7.tmp 1072 34F5.tmp 1692 3534.tmp 1300 3572.tmp 1572 35B0.tmp 2016 35EF.tmp 852 362D.tmp 2984 366C.tmp 1920 36AA.tmp 1724 36E8.tmp 1856 3727.tmp 2852 3765.tmp 1108 37B3.tmp 2344 37F2.tmp 892 3830.tmp 2188 386E.tmp 2088 38AD.tmp 1500 38FB.tmp 2308 3939.tmp 2084 3978.tmp 2940 39B6.tmp 2696 39F4.tmp 2692 3A42.tmp 2676 3A90.tmp 1212 3AEE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2940 2400 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 28 PID 2400 wrote to memory of 2940 2400 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 28 PID 2400 wrote to memory of 2940 2400 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 28 PID 2400 wrote to memory of 2940 2400 2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe 28 PID 2940 wrote to memory of 3068 2940 27CC.tmp 29 PID 2940 wrote to memory of 3068 2940 27CC.tmp 29 PID 2940 wrote to memory of 3068 2940 27CC.tmp 29 PID 2940 wrote to memory of 3068 2940 27CC.tmp 29 PID 3068 wrote to memory of 2684 3068 2839.tmp 30 PID 3068 wrote to memory of 2684 3068 2839.tmp 30 PID 3068 wrote to memory of 2684 3068 2839.tmp 30 PID 3068 wrote to memory of 2684 3068 2839.tmp 30 PID 2684 wrote to memory of 2632 2684 28B6.tmp 31 PID 2684 wrote to memory of 2632 2684 28B6.tmp 31 PID 2684 wrote to memory of 2632 2684 28B6.tmp 31 PID 2684 wrote to memory of 2632 2684 28B6.tmp 31 PID 2632 wrote to memory of 2744 2632 2923.tmp 32 PID 2632 wrote to memory of 2744 2632 2923.tmp 32 PID 2632 wrote to memory of 2744 2632 2923.tmp 32 PID 2632 wrote to memory of 2744 2632 2923.tmp 32 PID 2744 wrote to memory of 2504 2744 2961.tmp 33 PID 2744 wrote to memory of 2504 2744 2961.tmp 33 PID 2744 wrote to memory of 2504 2744 2961.tmp 33 PID 2744 wrote to memory of 2504 2744 2961.tmp 33 PID 2504 wrote to memory of 2612 2504 29BF.tmp 34 PID 2504 wrote to memory of 2612 2504 29BF.tmp 34 PID 2504 wrote to memory of 2612 2504 29BF.tmp 34 PID 2504 wrote to memory of 2612 2504 29BF.tmp 34 PID 2612 wrote to memory of 2472 2612 2A0D.tmp 35 PID 2612 wrote to memory of 2472 2612 2A0D.tmp 35 PID 2612 wrote to memory of 2472 2612 2A0D.tmp 35 PID 2612 wrote to memory of 2472 2612 2A0D.tmp 35 PID 2472 wrote to memory of 2596 2472 2A6A.tmp 36 PID 2472 wrote to memory of 2596 2472 2A6A.tmp 36 PID 2472 wrote to memory of 2596 2472 2A6A.tmp 36 PID 2472 wrote to memory of 2596 2472 2A6A.tmp 36 PID 2596 wrote to memory of 2648 2596 2AC8.tmp 37 PID 2596 wrote to memory of 2648 2596 2AC8.tmp 37 PID 2596 wrote to memory of 2648 2596 2AC8.tmp 37 PID 2596 wrote to memory of 2648 2596 2AC8.tmp 37 PID 2648 wrote to memory of 324 2648 2B35.tmp 38 PID 2648 wrote to memory of 324 2648 2B35.tmp 38 PID 2648 wrote to memory of 324 2648 2B35.tmp 38 PID 2648 wrote to memory of 324 2648 2B35.tmp 38 PID 324 wrote to memory of 1544 324 2BA2.tmp 39 PID 324 wrote to memory of 1544 324 2BA2.tmp 39 PID 324 wrote to memory of 1544 324 2BA2.tmp 39 PID 324 wrote to memory of 1544 324 2BA2.tmp 39 PID 1544 wrote to memory of 2780 1544 2C10.tmp 40 PID 1544 wrote to memory of 2780 1544 2C10.tmp 40 PID 1544 wrote to memory of 2780 1544 2C10.tmp 40 PID 1544 wrote to memory of 2780 1544 2C10.tmp 40 PID 2780 wrote to memory of 1736 2780 2C8C.tmp 41 PID 2780 wrote to memory of 1736 2780 2C8C.tmp 41 PID 2780 wrote to memory of 1736 2780 2C8C.tmp 41 PID 2780 wrote to memory of 1736 2780 2C8C.tmp 41 PID 1736 wrote to memory of 2180 1736 2CEA.tmp 42 PID 1736 wrote to memory of 2180 1736 2CEA.tmp 42 PID 1736 wrote to memory of 2180 1736 2CEA.tmp 42 PID 1736 wrote to memory of 2180 1736 2CEA.tmp 42 PID 2180 wrote to memory of 2184 2180 2D67.tmp 43 PID 2180 wrote to memory of 2184 2180 2D67.tmp 43 PID 2180 wrote to memory of 2184 2180 2D67.tmp 43 PID 2180 wrote to memory of 2184 2180 2D67.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-17_a55ee48c98c13b4bc83fe99e428f1259_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"65⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"66⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"67⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"68⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"69⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"70⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"71⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"73⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"74⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"75⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"76⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"77⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"78⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"79⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"80⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"81⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"82⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"83⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"84⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"85⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"86⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"87⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"88⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"89⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"90⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"91⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"92⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"93⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"94⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"95⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"96⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"97⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"98⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"99⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"100⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"101⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"102⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"103⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"104⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"105⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"106⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"107⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"108⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"109⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"110⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"111⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"112⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"113⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"114⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"115⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"116⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"117⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"118⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"119⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"121⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-