Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe
-
Size
487KB
-
MD5
466865641a93cde7444fd14d74391b08
-
SHA1
6257f7db7abfb7bbaea528ccad2c8ca285a0e868
-
SHA256
b7f5154771a85288629d0f9b1c8801976b173adcd9500fbed38890adeabbf533
-
SHA512
3bbc355d331eb3e15125e2bf0db23c6258f98dee83a97ef2a933163677b90354f9fedd0b89bbfce76e473438b51db70848707960dea05a81495d0272745ead45
-
SSDEEP
12288:HU5rCOTeiJxZpS3Vqi7iITt2y47BvTDnR2w90LvatUsNZ:HUQOJJxZgqi7zkfBvTDnR2mwC+sN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 8CD5.tmp 2808 8D80.tmp 2828 8EF7.tmp 2852 8FE1.tmp 2728 909C.tmp 2636 9147.tmp 2656 91D4.tmp 2628 92ED.tmp 1452 93F6.tmp 2248 94E0.tmp 3012 95CA.tmp 2556 9695.tmp 1948 979E.tmp 2276 9897.tmp 2964 99B0.tmp 2320 9A6B.tmp 3064 9B84.tmp 2708 9C30.tmp 792 9D1A.tmp 2460 9E33.tmp 1476 A0F1.tmp 572 A1DB.tmp 2156 A296.tmp 2220 A313.tmp 1284 A3DD.tmp 2208 A45A.tmp 2184 A4E7.tmp 2832 A563.tmp 1780 A5F0.tmp 2188 A68C.tmp 664 A728.tmp 828 A7B4.tmp 1512 A831.tmp 1720 A8BD.tmp 1620 A93A.tmp 1528 A9B7.tmp 1556 AA43.tmp 1712 AAB1.tmp 1964 AB4D.tmp 592 ABC9.tmp 2432 AC65.tmp 2672 AD11.tmp 912 AD8E.tmp 2416 AE0B.tmp 996 AE97.tmp 2236 AF23.tmp 1632 AFBF.tmp 860 B05B.tmp 1616 B0D8.tmp 1412 B155.tmp 2136 B1F1.tmp 1568 B25E.tmp 1588 B2BC.tmp 2716 B319.tmp 1072 B3A6.tmp 2740 B432.tmp 1652 B606.tmp 2924 B72F.tmp 1056 B7CB.tmp 2784 B867.tmp 2780 B8E3.tmp 2960 B98F.tmp 2612 BA0C.tmp 2876 BA89.tmp -
Loads dropped DLL 64 IoCs
pid Process 2112 2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe 2388 8CD5.tmp 2808 8D80.tmp 2828 8EF7.tmp 2852 8FE1.tmp 2728 909C.tmp 2636 9147.tmp 2656 91D4.tmp 2628 92ED.tmp 1452 93F6.tmp 2248 94E0.tmp 3012 95CA.tmp 2556 9695.tmp 1948 979E.tmp 2276 9897.tmp 2964 99B0.tmp 2320 9A6B.tmp 3064 9B84.tmp 2708 9C30.tmp 792 9D1A.tmp 2460 9E33.tmp 1476 A0F1.tmp 572 A1DB.tmp 2156 A296.tmp 2220 A313.tmp 1284 A3DD.tmp 2208 A45A.tmp 2184 A4E7.tmp 2832 A563.tmp 1780 A5F0.tmp 2188 A68C.tmp 664 A728.tmp 828 A7B4.tmp 1512 A831.tmp 1720 A8BD.tmp 1620 A93A.tmp 1528 A9B7.tmp 1556 AA43.tmp 1712 AAB1.tmp 1964 AB4D.tmp 592 ABC9.tmp 2432 AC65.tmp 2672 AD11.tmp 912 AD8E.tmp 2416 AE0B.tmp 996 AE97.tmp 2236 AF23.tmp 1632 AFBF.tmp 860 B05B.tmp 1616 B0D8.tmp 1412 B155.tmp 2136 B1F1.tmp 1568 B25E.tmp 1588 B2BC.tmp 2716 B319.tmp 1072 B3A6.tmp 2740 B432.tmp 1652 B606.tmp 2924 B72F.tmp 1056 B7CB.tmp 2784 B867.tmp 2780 B8E3.tmp 2960 B98F.tmp 2612 BA0C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2388 2112 2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe 30 PID 2112 wrote to memory of 2388 2112 2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe 30 PID 2112 wrote to memory of 2388 2112 2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe 30 PID 2112 wrote to memory of 2388 2112 2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe 30 PID 2388 wrote to memory of 2808 2388 8CD5.tmp 31 PID 2388 wrote to memory of 2808 2388 8CD5.tmp 31 PID 2388 wrote to memory of 2808 2388 8CD5.tmp 31 PID 2388 wrote to memory of 2808 2388 8CD5.tmp 31 PID 2808 wrote to memory of 2828 2808 8D80.tmp 32 PID 2808 wrote to memory of 2828 2808 8D80.tmp 32 PID 2808 wrote to memory of 2828 2808 8D80.tmp 32 PID 2808 wrote to memory of 2828 2808 8D80.tmp 32 PID 2828 wrote to memory of 2852 2828 8EF7.tmp 33 PID 2828 wrote to memory of 2852 2828 8EF7.tmp 33 PID 2828 wrote to memory of 2852 2828 8EF7.tmp 33 PID 2828 wrote to memory of 2852 2828 8EF7.tmp 33 PID 2852 wrote to memory of 2728 2852 8FE1.tmp 34 PID 2852 wrote to memory of 2728 2852 8FE1.tmp 34 PID 2852 wrote to memory of 2728 2852 8FE1.tmp 34 PID 2852 wrote to memory of 2728 2852 8FE1.tmp 34 PID 2728 wrote to memory of 2636 2728 909C.tmp 35 PID 2728 wrote to memory of 2636 2728 909C.tmp 35 PID 2728 wrote to memory of 2636 2728 909C.tmp 35 PID 2728 wrote to memory of 2636 2728 909C.tmp 35 PID 2636 wrote to memory of 2656 2636 9147.tmp 36 PID 2636 wrote to memory of 2656 2636 9147.tmp 36 PID 2636 wrote to memory of 2656 2636 9147.tmp 36 PID 2636 wrote to memory of 2656 2636 9147.tmp 36 PID 2656 wrote to memory of 2628 2656 91D4.tmp 37 PID 2656 wrote to memory of 2628 2656 91D4.tmp 37 PID 2656 wrote to memory of 2628 2656 91D4.tmp 37 PID 2656 wrote to memory of 2628 2656 91D4.tmp 37 PID 2628 wrote to memory of 1452 2628 92ED.tmp 38 PID 2628 wrote to memory of 1452 2628 92ED.tmp 38 PID 2628 wrote to memory of 1452 2628 92ED.tmp 38 PID 2628 wrote to memory of 1452 2628 92ED.tmp 38 PID 1452 wrote to memory of 2248 1452 93F6.tmp 39 PID 1452 wrote to memory of 2248 1452 93F6.tmp 39 PID 1452 wrote to memory of 2248 1452 93F6.tmp 39 PID 1452 wrote to memory of 2248 1452 93F6.tmp 39 PID 2248 wrote to memory of 3012 2248 94E0.tmp 40 PID 2248 wrote to memory of 3012 2248 94E0.tmp 40 PID 2248 wrote to memory of 3012 2248 94E0.tmp 40 PID 2248 wrote to memory of 3012 2248 94E0.tmp 40 PID 3012 wrote to memory of 2556 3012 95CA.tmp 41 PID 3012 wrote to memory of 2556 3012 95CA.tmp 41 PID 3012 wrote to memory of 2556 3012 95CA.tmp 41 PID 3012 wrote to memory of 2556 3012 95CA.tmp 41 PID 2556 wrote to memory of 1948 2556 9695.tmp 42 PID 2556 wrote to memory of 1948 2556 9695.tmp 42 PID 2556 wrote to memory of 1948 2556 9695.tmp 42 PID 2556 wrote to memory of 1948 2556 9695.tmp 42 PID 1948 wrote to memory of 2276 1948 979E.tmp 43 PID 1948 wrote to memory of 2276 1948 979E.tmp 43 PID 1948 wrote to memory of 2276 1948 979E.tmp 43 PID 1948 wrote to memory of 2276 1948 979E.tmp 43 PID 2276 wrote to memory of 2964 2276 9897.tmp 44 PID 2276 wrote to memory of 2964 2276 9897.tmp 44 PID 2276 wrote to memory of 2964 2276 9897.tmp 44 PID 2276 wrote to memory of 2964 2276 9897.tmp 44 PID 2964 wrote to memory of 2320 2964 99B0.tmp 45 PID 2964 wrote to memory of 2320 2964 99B0.tmp 45 PID 2964 wrote to memory of 2320 2964 99B0.tmp 45 PID 2964 wrote to memory of 2320 2964 99B0.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-11_466865641a93cde7444fd14d74391b08_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"C:\Users\Admin\AppData\Local\Temp\8FE1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\AE97.tmp"C:\Users\Admin\AppData\Local\Temp\AE97.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\BA89.tmp"C:\Users\Admin\AppData\Local\Temp\BA89.tmp"65⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"66⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"67⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"68⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"69⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"70⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"71⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"C:\Users\Admin\AppData\Local\Temp\BE6F.tmp"72⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"C:\Users\Admin\AppData\Local\Temp\BEEC.tmp"73⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"74⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"75⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"76⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"77⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"78⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"79⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"80⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"81⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"82⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"83⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"84⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\C468.tmp"C:\Users\Admin\AppData\Local\Temp\C468.tmp"85⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"86⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"87⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"88⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"89⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"90⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"91⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"92⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"93⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"94⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"96⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"97⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"98⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"99⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"100⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"101⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"102⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"103⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"104⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"105⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"106⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"107⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"108⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"109⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\D24D.tmp"C:\Users\Admin\AppData\Local\Temp\D24D.tmp"110⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\D2CA.tmp"C:\Users\Admin\AppData\Local\Temp\D2CA.tmp"111⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\D366.tmp"C:\Users\Admin\AppData\Local\Temp\D366.tmp"112⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"C:\Users\Admin\AppData\Local\Temp\D3E2.tmp"113⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"114⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"115⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"116⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"117⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"118⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"119⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\D7AA.tmp"C:\Users\Admin\AppData\Local\Temp\D7AA.tmp"120⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"121⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-