Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe
-
Size
520KB
-
MD5
67968539e3de556798991e70c587bd49
-
SHA1
2eb7f5be40b7244c38fa28e2aae733f9e3a434f4
-
SHA256
950fae2af383fdaaa09e028b39ddb7a8dd0cc7ec7000c4c1e4d3c6663a0a2e4c
-
SHA512
d6c0958884360c7d5b6b2687103f163e84ee79fb1617db73cf8fec1a09dec3018b326da955f58aee8a24e74e066bc1fb568573577d0e5fcc1414aa4a056830be
-
SSDEEP
12288:roRXOQjmOyBJa2ajoqTtoDSMxg/Kt2wFcNNZ:rogQ9y/a2rSouMxg/Kt2+cNN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2604 7A6D.tmp 2108 7B38.tmp 2712 7C8F.tmp 2576 7D99.tmp 2276 7EA2.tmp 2772 7FBB.tmp 2444 80D3.tmp 2468 81CD.tmp 2440 82B7.tmp 2932 8391.tmp 2948 845C.tmp 772 8585.tmp 1076 867E.tmp 1728 87A7.tmp 1872 8891.tmp 2800 89A9.tmp 2904 8A84.tmp 2516 8B6E.tmp 1428 8C58.tmp 2012 8D71.tmp 1828 8E4B.tmp 2008 8F64.tmp 2684 904E.tmp 696 90DA.tmp 1040 9157.tmp 1036 91D4.tmp 1768 927F.tmp 1932 92ED.tmp 2260 935A.tmp 768 93E6.tmp 2280 9463.tmp 2272 94E0.tmp 2876 955D.tmp 2092 95E9.tmp 992 9656.tmp 1980 96C3.tmp 964 976F.tmp 1052 97FB.tmp 1504 9878.tmp 1748 98F5.tmp 2784 9981.tmp 1880 99EF.tmp 1156 9A7B.tmp 1320 9AF8.tmp 920 9B75.tmp 2208 9BF1.tmp 2844 9C7E.tmp 1684 9CEB.tmp 2908 9D58.tmp 1676 9DE5.tmp 2912 9E71.tmp 3020 9EFD.tmp 1952 9F8A.tmp 2988 A016.tmp 1548 A093.tmp 1564 A11F.tmp 3016 A1DB.tmp 2604 A2B5.tmp 2740 A341.tmp 2752 A3BE.tmp 2708 A41C.tmp 2428 A489.tmp 2768 A515.tmp 2620 A592.tmp -
Loads dropped DLL 64 IoCs
pid Process 1656 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 2604 7A6D.tmp 2108 7B38.tmp 2712 7C8F.tmp 2576 7D99.tmp 2276 7EA2.tmp 2772 7FBB.tmp 2444 80D3.tmp 2468 81CD.tmp 2440 82B7.tmp 2932 8391.tmp 2948 845C.tmp 772 8585.tmp 1076 867E.tmp 1728 87A7.tmp 1872 8891.tmp 2800 89A9.tmp 2904 8A84.tmp 2516 8B6E.tmp 1428 8C58.tmp 2012 8D71.tmp 1828 8E4B.tmp 2008 8F64.tmp 2684 904E.tmp 696 90DA.tmp 1040 9157.tmp 1036 91D4.tmp 1768 927F.tmp 1932 92ED.tmp 2260 935A.tmp 768 93E6.tmp 2280 9463.tmp 2272 94E0.tmp 2876 955D.tmp 2092 95E9.tmp 992 9656.tmp 1980 96C3.tmp 964 976F.tmp 1052 97FB.tmp 1504 9878.tmp 1748 98F5.tmp 2784 9981.tmp 1880 99EF.tmp 1156 9A7B.tmp 1320 9AF8.tmp 920 9B75.tmp 2208 9BF1.tmp 2844 9C7E.tmp 1684 9CEB.tmp 2908 9D58.tmp 1676 9DE5.tmp 2912 9E71.tmp 3020 9EFD.tmp 1952 9F8A.tmp 2988 A016.tmp 1548 A093.tmp 1564 A11F.tmp 3016 A1DB.tmp 2604 A2B5.tmp 2740 A341.tmp 2752 A3BE.tmp 2708 A41C.tmp 2428 A489.tmp 2768 A515.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2604 1656 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 28 PID 1656 wrote to memory of 2604 1656 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 28 PID 1656 wrote to memory of 2604 1656 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 28 PID 1656 wrote to memory of 2604 1656 2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe 28 PID 2604 wrote to memory of 2108 2604 7A6D.tmp 29 PID 2604 wrote to memory of 2108 2604 7A6D.tmp 29 PID 2604 wrote to memory of 2108 2604 7A6D.tmp 29 PID 2604 wrote to memory of 2108 2604 7A6D.tmp 29 PID 2108 wrote to memory of 2712 2108 7B38.tmp 30 PID 2108 wrote to memory of 2712 2108 7B38.tmp 30 PID 2108 wrote to memory of 2712 2108 7B38.tmp 30 PID 2108 wrote to memory of 2712 2108 7B38.tmp 30 PID 2712 wrote to memory of 2576 2712 7C8F.tmp 31 PID 2712 wrote to memory of 2576 2712 7C8F.tmp 31 PID 2712 wrote to memory of 2576 2712 7C8F.tmp 31 PID 2712 wrote to memory of 2576 2712 7C8F.tmp 31 PID 2576 wrote to memory of 2276 2576 7D99.tmp 32 PID 2576 wrote to memory of 2276 2576 7D99.tmp 32 PID 2576 wrote to memory of 2276 2576 7D99.tmp 32 PID 2576 wrote to memory of 2276 2576 7D99.tmp 32 PID 2276 wrote to memory of 2772 2276 7EA2.tmp 33 PID 2276 wrote to memory of 2772 2276 7EA2.tmp 33 PID 2276 wrote to memory of 2772 2276 7EA2.tmp 33 PID 2276 wrote to memory of 2772 2276 7EA2.tmp 33 PID 2772 wrote to memory of 2444 2772 7FBB.tmp 34 PID 2772 wrote to memory of 2444 2772 7FBB.tmp 34 PID 2772 wrote to memory of 2444 2772 7FBB.tmp 34 PID 2772 wrote to memory of 2444 2772 7FBB.tmp 34 PID 2444 wrote to memory of 2468 2444 80D3.tmp 35 PID 2444 wrote to memory of 2468 2444 80D3.tmp 35 PID 2444 wrote to memory of 2468 2444 80D3.tmp 35 PID 2444 wrote to memory of 2468 2444 80D3.tmp 35 PID 2468 wrote to memory of 2440 2468 81CD.tmp 36 PID 2468 wrote to memory of 2440 2468 81CD.tmp 36 PID 2468 wrote to memory of 2440 2468 81CD.tmp 36 PID 2468 wrote to memory of 2440 2468 81CD.tmp 36 PID 2440 wrote to memory of 2932 2440 82B7.tmp 37 PID 2440 wrote to memory of 2932 2440 82B7.tmp 37 PID 2440 wrote to memory of 2932 2440 82B7.tmp 37 PID 2440 wrote to memory of 2932 2440 82B7.tmp 37 PID 2932 wrote to memory of 2948 2932 8391.tmp 38 PID 2932 wrote to memory of 2948 2932 8391.tmp 38 PID 2932 wrote to memory of 2948 2932 8391.tmp 38 PID 2932 wrote to memory of 2948 2932 8391.tmp 38 PID 2948 wrote to memory of 772 2948 845C.tmp 39 PID 2948 wrote to memory of 772 2948 845C.tmp 39 PID 2948 wrote to memory of 772 2948 845C.tmp 39 PID 2948 wrote to memory of 772 2948 845C.tmp 39 PID 772 wrote to memory of 1076 772 8585.tmp 40 PID 772 wrote to memory of 1076 772 8585.tmp 40 PID 772 wrote to memory of 1076 772 8585.tmp 40 PID 772 wrote to memory of 1076 772 8585.tmp 40 PID 1076 wrote to memory of 1728 1076 867E.tmp 41 PID 1076 wrote to memory of 1728 1076 867E.tmp 41 PID 1076 wrote to memory of 1728 1076 867E.tmp 41 PID 1076 wrote to memory of 1728 1076 867E.tmp 41 PID 1728 wrote to memory of 1872 1728 87A7.tmp 42 PID 1728 wrote to memory of 1872 1728 87A7.tmp 42 PID 1728 wrote to memory of 1872 1728 87A7.tmp 42 PID 1728 wrote to memory of 1872 1728 87A7.tmp 42 PID 1872 wrote to memory of 2800 1872 8891.tmp 43 PID 1872 wrote to memory of 2800 1872 8891.tmp 43 PID 1872 wrote to memory of 2800 1872 8891.tmp 43 PID 1872 wrote to memory of 2800 1872 8891.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_67968539e3de556798991e70c587bd49_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\8891.tmp"C:\Users\Admin\AppData\Local\Temp\8891.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"66⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"67⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"68⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"69⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"70⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"72⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"73⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"74⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"75⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"76⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"77⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"78⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"79⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"80⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"81⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"82⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"83⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"84⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"85⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"86⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"87⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"88⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"89⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"90⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"91⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"92⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"93⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"94⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"95⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"97⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"99⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"100⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"101⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"103⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"104⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"105⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"106⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"107⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"108⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"109⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"110⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"112⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"113⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"114⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"115⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"116⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"117⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"118⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"119⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"120⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"121⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-