Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe
-
Size
488KB
-
MD5
5bd5904ab61550ea7351eab581051719
-
SHA1
6771d90c32b642740ddb7ad0db265a4b46ec32f7
-
SHA256
8a9d17a7a9652a57122368e532c10d0e52305b3ce13d8c5fcd41aa6ddc337a01
-
SHA512
8a01e7fdf3fed9e56201cd2e5f075b257db589a278359cee3b3a4eb1c8c37d1caec4c331835788460572e850205f806cd01adc6addef2eaf6ba240be9e7da40b
-
SSDEEP
12288:/U5rCOTeiDkbbQL0qBR/O8DZcDcWSbzNeyNZ:/UQOJDMQLfLOSbzrN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2104 8DDE.tmp 2340 8E5B.tmp 1044 8EC8.tmp 2404 8F25.tmp 2280 8F93.tmp 2440 9000.tmp 2688 905D.tmp 2612 90CB.tmp 2732 9128.tmp 2736 9186.tmp 2620 91E3.tmp 2152 9251.tmp 2260 92CD.tmp 2556 932B.tmp 2520 9389.tmp 2948 93F6.tmp 2968 9453.tmp 1292 94B1.tmp 2572 950F.tmp 344 957C.tmp 1992 95CA.tmp 1712 9637.tmp 1932 9695.tmp 1980 96D3.tmp 2788 9711.tmp 1768 975F.tmp 2848 979E.tmp 2836 97FB.tmp 2160 983A.tmp 2364 9878.tmp 2080 98B7.tmp 2600 98F5.tmp 1748 9933.tmp 2856 9962.tmp 1608 99A1.tmp 1540 99DF.tmp 692 9A1D.tmp 2036 9A5C.tmp 1600 9A9A.tmp 1816 9AD9.tmp 1372 9B17.tmp 844 9B55.tmp 1792 9B94.tmp 1148 9BD2.tmp 1256 9C11.tmp 1476 9C5F.tmp 2212 9C9D.tmp 3052 9CDB.tmp 2940 9D1A.tmp 864 9D68.tmp 2052 9DA6.tmp 1728 9DE5.tmp 872 9E23.tmp 2124 9E71.tmp 3008 9EAF.tmp 2072 9F3C.tmp 1760 9F7A.tmp 2104 9FB9.tmp 2312 9FF7.tmp 1636 A035.tmp 2244 A074.tmp 2156 A0C2.tmp 2428 A100.tmp 2076 A13F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2408 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 2104 8DDE.tmp 2340 8E5B.tmp 1044 8EC8.tmp 2404 8F25.tmp 2280 8F93.tmp 2440 9000.tmp 2688 905D.tmp 2612 90CB.tmp 2732 9128.tmp 2736 9186.tmp 2620 91E3.tmp 2152 9251.tmp 2260 92CD.tmp 2556 932B.tmp 2520 9389.tmp 2948 93F6.tmp 2968 9453.tmp 1292 94B1.tmp 2572 950F.tmp 344 957C.tmp 1992 95CA.tmp 1712 9637.tmp 1932 9695.tmp 1980 96D3.tmp 2788 9711.tmp 1768 975F.tmp 2848 979E.tmp 2836 97FB.tmp 2160 983A.tmp 2364 9878.tmp 2080 98B7.tmp 2600 98F5.tmp 1748 9933.tmp 2856 9962.tmp 1608 99A1.tmp 1540 99DF.tmp 692 9A1D.tmp 2036 9A5C.tmp 1600 9A9A.tmp 1816 9AD9.tmp 1372 9B17.tmp 844 9B55.tmp 1792 9B94.tmp 1148 9BD2.tmp 1256 9C11.tmp 1476 9C5F.tmp 2212 9C9D.tmp 3052 9CDB.tmp 2940 9D1A.tmp 864 9D68.tmp 2052 9DA6.tmp 1728 9DE5.tmp 872 9E23.tmp 2124 9E71.tmp 1640 9EEE.tmp 2072 9F3C.tmp 1760 9F7A.tmp 2104 9FB9.tmp 2312 9FF7.tmp 1636 A035.tmp 2244 A074.tmp 2156 A0C2.tmp 2428 A100.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2104 2408 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 28 PID 2408 wrote to memory of 2104 2408 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 28 PID 2408 wrote to memory of 2104 2408 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 28 PID 2408 wrote to memory of 2104 2408 2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe 28 PID 2104 wrote to memory of 2340 2104 8DDE.tmp 29 PID 2104 wrote to memory of 2340 2104 8DDE.tmp 29 PID 2104 wrote to memory of 2340 2104 8DDE.tmp 29 PID 2104 wrote to memory of 2340 2104 8DDE.tmp 29 PID 2340 wrote to memory of 1044 2340 8E5B.tmp 30 PID 2340 wrote to memory of 1044 2340 8E5B.tmp 30 PID 2340 wrote to memory of 1044 2340 8E5B.tmp 30 PID 2340 wrote to memory of 1044 2340 8E5B.tmp 30 PID 1044 wrote to memory of 2404 1044 8EC8.tmp 31 PID 1044 wrote to memory of 2404 1044 8EC8.tmp 31 PID 1044 wrote to memory of 2404 1044 8EC8.tmp 31 PID 1044 wrote to memory of 2404 1044 8EC8.tmp 31 PID 2404 wrote to memory of 2280 2404 8F25.tmp 32 PID 2404 wrote to memory of 2280 2404 8F25.tmp 32 PID 2404 wrote to memory of 2280 2404 8F25.tmp 32 PID 2404 wrote to memory of 2280 2404 8F25.tmp 32 PID 2280 wrote to memory of 2440 2280 8F93.tmp 33 PID 2280 wrote to memory of 2440 2280 8F93.tmp 33 PID 2280 wrote to memory of 2440 2280 8F93.tmp 33 PID 2280 wrote to memory of 2440 2280 8F93.tmp 33 PID 2440 wrote to memory of 2688 2440 9000.tmp 34 PID 2440 wrote to memory of 2688 2440 9000.tmp 34 PID 2440 wrote to memory of 2688 2440 9000.tmp 34 PID 2440 wrote to memory of 2688 2440 9000.tmp 34 PID 2688 wrote to memory of 2612 2688 905D.tmp 35 PID 2688 wrote to memory of 2612 2688 905D.tmp 35 PID 2688 wrote to memory of 2612 2688 905D.tmp 35 PID 2688 wrote to memory of 2612 2688 905D.tmp 35 PID 2612 wrote to memory of 2732 2612 90CB.tmp 36 PID 2612 wrote to memory of 2732 2612 90CB.tmp 36 PID 2612 wrote to memory of 2732 2612 90CB.tmp 36 PID 2612 wrote to memory of 2732 2612 90CB.tmp 36 PID 2732 wrote to memory of 2736 2732 9128.tmp 37 PID 2732 wrote to memory of 2736 2732 9128.tmp 37 PID 2732 wrote to memory of 2736 2732 9128.tmp 37 PID 2732 wrote to memory of 2736 2732 9128.tmp 37 PID 2736 wrote to memory of 2620 2736 9186.tmp 38 PID 2736 wrote to memory of 2620 2736 9186.tmp 38 PID 2736 wrote to memory of 2620 2736 9186.tmp 38 PID 2736 wrote to memory of 2620 2736 9186.tmp 38 PID 2620 wrote to memory of 2152 2620 91E3.tmp 39 PID 2620 wrote to memory of 2152 2620 91E3.tmp 39 PID 2620 wrote to memory of 2152 2620 91E3.tmp 39 PID 2620 wrote to memory of 2152 2620 91E3.tmp 39 PID 2152 wrote to memory of 2260 2152 9251.tmp 40 PID 2152 wrote to memory of 2260 2152 9251.tmp 40 PID 2152 wrote to memory of 2260 2152 9251.tmp 40 PID 2152 wrote to memory of 2260 2152 9251.tmp 40 PID 2260 wrote to memory of 2556 2260 92CD.tmp 41 PID 2260 wrote to memory of 2556 2260 92CD.tmp 41 PID 2260 wrote to memory of 2556 2260 92CD.tmp 41 PID 2260 wrote to memory of 2556 2260 92CD.tmp 41 PID 2556 wrote to memory of 2520 2556 932B.tmp 42 PID 2556 wrote to memory of 2520 2556 932B.tmp 42 PID 2556 wrote to memory of 2520 2556 932B.tmp 42 PID 2556 wrote to memory of 2520 2556 932B.tmp 42 PID 2520 wrote to memory of 2948 2520 9389.tmp 43 PID 2520 wrote to memory of 2948 2520 9389.tmp 43 PID 2520 wrote to memory of 2948 2520 9389.tmp 43 PID 2520 wrote to memory of 2948 2520 9389.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-22_5bd5904ab61550ea7351eab581051719_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\8F25.tmp"C:\Users\Admin\AppData\Local\Temp\8F25.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"56⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"57⤵
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\A035.tmp"C:\Users\Admin\AppData\Local\Temp\A035.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"66⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"67⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"68⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"69⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"70⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"71⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"72⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"73⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"74⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"75⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"76⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"77⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"78⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"79⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"80⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"81⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"82⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"83⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"84⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"86⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"87⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"88⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"89⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"90⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"91⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"92⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"93⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"94⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"95⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"96⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"97⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"98⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"99⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"100⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"101⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"102⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"103⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"104⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"105⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"106⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"107⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"108⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"109⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"110⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"111⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"112⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"113⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"114⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"115⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"116⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"117⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"118⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"119⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"121⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"122⤵PID:1348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-