Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 07:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe
-
Size
520KB
-
MD5
09e98e98da27cce31b0614c0dd213102
-
SHA1
29381b0154f4c1e192af14c5aaf684cd86d0d0fe
-
SHA256
57b95d1d64f979bbb103840561f3ca086b4f35077b7b07483d9795886fe09d5a
-
SHA512
d43498103d55ef1ad6a351f60b6c5e69ea00b63761a4765ce739541857ba49deaa2d8ed16873591a03b6bc739a4ee66f75bef623ba6c807df408d31bc17ef353
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLCrj9yUTUVRAtt+RtNWMGZoFPpE8Vg/vBQVFQf:roRXOQjmOyyv9yU6I+TE8Vq63QwUlNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1712 2858.tmp 1192 28C5.tmp 2052 2971.tmp 2584 29FD.tmp 2752 2A8A.tmp 2572 2B06.tmp 2600 2B93.tmp 2804 2C00.tmp 2608 2C8C.tmp 2452 2CEA.tmp 2212 2D38.tmp 1996 2DA5.tmp 2508 2E41.tmp 2704 2EFC.tmp 2808 2FA8.tmp 1520 3044.tmp 1300 30D0.tmp 1856 315D.tmp 1464 31E9.tmp 1444 3256.tmp 1408 32E3.tmp 712 337F.tmp 988 33CD.tmp 2336 340B.tmp 1252 3469.tmp 860 34B7.tmp 2944 3505.tmp 2136 3543.tmp 2920 3591.tmp 2204 35D0.tmp 2120 361E.tmp 2276 365C.tmp 1692 36AA.tmp 1740 36E8.tmp 1680 3736.tmp 2924 3784.tmp 2392 37C3.tmp 420 3801.tmp 2172 385F.tmp 1720 38AD.tmp 2864 38FB.tmp 1928 3939.tmp 1396 3987.tmp 1604 39C6.tmp 3016 3A14.tmp 772 3A62.tmp 2200 3AB0.tmp 620 3AFE.tmp 1820 3B4C.tmp 1608 3B9A.tmp 1976 3BF7.tmp 1748 3C36.tmp 296 3C84.tmp 1808 3CD2.tmp 1560 3D10.tmp 1700 3D5E.tmp 1792 3D9C.tmp 2012 3DEA.tmp 2532 3E38.tmp 2284 3E96.tmp 2696 3EE4.tmp 2680 3F32.tmp 2852 3F80.tmp 2836 3FBE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2128 2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe 1712 2858.tmp 1192 28C5.tmp 2052 2971.tmp 2584 29FD.tmp 2752 2A8A.tmp 2572 2B06.tmp 2600 2B93.tmp 2804 2C00.tmp 2608 2C8C.tmp 2452 2CEA.tmp 2212 2D38.tmp 1996 2DA5.tmp 2508 2E41.tmp 2704 2EFC.tmp 2808 2FA8.tmp 1520 3044.tmp 1300 30D0.tmp 1856 315D.tmp 1464 31E9.tmp 1444 3256.tmp 1408 32E3.tmp 712 337F.tmp 988 33CD.tmp 2336 340B.tmp 1252 3469.tmp 860 34B7.tmp 2944 3505.tmp 2136 3543.tmp 2920 3591.tmp 2204 35D0.tmp 2120 361E.tmp 2276 365C.tmp 1692 36AA.tmp 1740 36E8.tmp 1680 3736.tmp 2924 3784.tmp 2392 37C3.tmp 420 3801.tmp 2172 385F.tmp 1720 38AD.tmp 2864 38FB.tmp 1928 3939.tmp 1396 3987.tmp 1604 39C6.tmp 3016 3A14.tmp 772 3A62.tmp 2200 3AB0.tmp 620 3AFE.tmp 1820 3B4C.tmp 1608 3B9A.tmp 1976 3BF7.tmp 1748 3C36.tmp 296 3C84.tmp 1808 3CD2.tmp 1560 3D10.tmp 1700 3D5E.tmp 1792 3D9C.tmp 2012 3DEA.tmp 2532 3E38.tmp 2284 3E96.tmp 2696 3EE4.tmp 2680 3F32.tmp 2852 3F80.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 1712 2128 2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe 28 PID 2128 wrote to memory of 1712 2128 2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe 28 PID 2128 wrote to memory of 1712 2128 2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe 28 PID 2128 wrote to memory of 1712 2128 2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe 28 PID 1712 wrote to memory of 1192 1712 2858.tmp 29 PID 1712 wrote to memory of 1192 1712 2858.tmp 29 PID 1712 wrote to memory of 1192 1712 2858.tmp 29 PID 1712 wrote to memory of 1192 1712 2858.tmp 29 PID 1192 wrote to memory of 2052 1192 28C5.tmp 30 PID 1192 wrote to memory of 2052 1192 28C5.tmp 30 PID 1192 wrote to memory of 2052 1192 28C5.tmp 30 PID 1192 wrote to memory of 2052 1192 28C5.tmp 30 PID 2052 wrote to memory of 2584 2052 2971.tmp 31 PID 2052 wrote to memory of 2584 2052 2971.tmp 31 PID 2052 wrote to memory of 2584 2052 2971.tmp 31 PID 2052 wrote to memory of 2584 2052 2971.tmp 31 PID 2584 wrote to memory of 2752 2584 29FD.tmp 32 PID 2584 wrote to memory of 2752 2584 29FD.tmp 32 PID 2584 wrote to memory of 2752 2584 29FD.tmp 32 PID 2584 wrote to memory of 2752 2584 29FD.tmp 32 PID 2752 wrote to memory of 2572 2752 2A8A.tmp 33 PID 2752 wrote to memory of 2572 2752 2A8A.tmp 33 PID 2752 wrote to memory of 2572 2752 2A8A.tmp 33 PID 2752 wrote to memory of 2572 2752 2A8A.tmp 33 PID 2572 wrote to memory of 2600 2572 2B06.tmp 34 PID 2572 wrote to memory of 2600 2572 2B06.tmp 34 PID 2572 wrote to memory of 2600 2572 2B06.tmp 34 PID 2572 wrote to memory of 2600 2572 2B06.tmp 34 PID 2600 wrote to memory of 2804 2600 2B93.tmp 35 PID 2600 wrote to memory of 2804 2600 2B93.tmp 35 PID 2600 wrote to memory of 2804 2600 2B93.tmp 35 PID 2600 wrote to memory of 2804 2600 2B93.tmp 35 PID 2804 wrote to memory of 2608 2804 2C00.tmp 36 PID 2804 wrote to memory of 2608 2804 2C00.tmp 36 PID 2804 wrote to memory of 2608 2804 2C00.tmp 36 PID 2804 wrote to memory of 2608 2804 2C00.tmp 36 PID 2608 wrote to memory of 2452 2608 2C8C.tmp 37 PID 2608 wrote to memory of 2452 2608 2C8C.tmp 37 PID 2608 wrote to memory of 2452 2608 2C8C.tmp 37 PID 2608 wrote to memory of 2452 2608 2C8C.tmp 37 PID 2452 wrote to memory of 2212 2452 2CEA.tmp 38 PID 2452 wrote to memory of 2212 2452 2CEA.tmp 38 PID 2452 wrote to memory of 2212 2452 2CEA.tmp 38 PID 2452 wrote to memory of 2212 2452 2CEA.tmp 38 PID 2212 wrote to memory of 1996 2212 2D38.tmp 39 PID 2212 wrote to memory of 1996 2212 2D38.tmp 39 PID 2212 wrote to memory of 1996 2212 2D38.tmp 39 PID 2212 wrote to memory of 1996 2212 2D38.tmp 39 PID 1996 wrote to memory of 2508 1996 2DA5.tmp 40 PID 1996 wrote to memory of 2508 1996 2DA5.tmp 40 PID 1996 wrote to memory of 2508 1996 2DA5.tmp 40 PID 1996 wrote to memory of 2508 1996 2DA5.tmp 40 PID 2508 wrote to memory of 2704 2508 2E41.tmp 41 PID 2508 wrote to memory of 2704 2508 2E41.tmp 41 PID 2508 wrote to memory of 2704 2508 2E41.tmp 41 PID 2508 wrote to memory of 2704 2508 2E41.tmp 41 PID 2704 wrote to memory of 2808 2704 2EFC.tmp 42 PID 2704 wrote to memory of 2808 2704 2EFC.tmp 42 PID 2704 wrote to memory of 2808 2704 2EFC.tmp 42 PID 2704 wrote to memory of 2808 2704 2EFC.tmp 42 PID 2808 wrote to memory of 1520 2808 2FA8.tmp 43 PID 2808 wrote to memory of 1520 2808 2FA8.tmp 43 PID 2808 wrote to memory of 1520 2808 2FA8.tmp 43 PID 2808 wrote to memory of 1520 2808 2FA8.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_09e98e98da27cce31b0614c0dd213102_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:420 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"65⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"66⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"67⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"68⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"69⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"70⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"71⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"72⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"73⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"74⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"75⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"76⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"77⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"78⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"79⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"80⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"81⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"82⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"83⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"84⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"85⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"86⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"87⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"88⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"89⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"90⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"91⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"92⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"93⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"94⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"95⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"96⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\4894.tmp"C:\Users\Admin\AppData\Local\Temp\4894.tmp"97⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"98⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"99⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"100⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"101⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"102⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"103⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"104⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"105⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"106⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"107⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"108⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"109⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"110⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"111⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"112⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"113⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"114⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"116⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\4E30.tmp"C:\Users\Admin\AppData\Local\Temp\4E30.tmp"117⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"118⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"119⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"120⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"121⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"122⤵PID:2140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-