Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 00:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe
-
Size
488KB
-
MD5
38b3c49c511b916aae84963541b7d1fc
-
SHA1
75a94603517038e811e2e9dcf6b10aef33fe78aa
-
SHA256
94d768e9e4c7808539ff8f0cf71953183db8e726e36ad2d38a79b4e342e39b46
-
SHA512
eed29dbbb5115bb111cb3b00b674747159748ac4be6e05228f5d35f46813620734ad2faf88fe0e533eb439f63e08c6019f4c501ad11cf911090e450346750c44
-
SSDEEP
12288:/U5rCOTeiD77KaLZzTIneLP6Nz0zz74jaBRtTVNZ:/UQOJDS2VTInemN+z7C8VN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1252 400C.tmp 2632 40A8.tmp 2648 4135.tmp 2768 41D1.tmp 2668 42DA.tmp 2316 4386.tmp 2832 4422.tmp 2716 44CD.tmp 2536 4569.tmp 2616 4624.tmp 1724 4692.tmp 1564 474D.tmp 2340 47E9.tmp 1304 4866.tmp 1120 4921.tmp 2588 499E.tmp 2828 4A0B.tmp 2896 4A78.tmp 2032 4BA0.tmp 2904 4C3C.tmp 2924 4CB9.tmp 596 4D46.tmp 1968 4E20.tmp 2224 4E7E.tmp 1424 4EEB.tmp 1448 4F48.tmp 2024 4FB6.tmp 1720 5023.tmp 1088 5090.tmp 3000 50DE.tmp 1108 514B.tmp 2332 51A9.tmp 1800 52F0.tmp 1844 5486.tmp 1788 55AE.tmp 2212 560C.tmp 1288 56A8.tmp 2504 5782.tmp 1680 580F.tmp 3020 588C.tmp 1656 58F9.tmp 1600 5976.tmp 1852 59E3.tmp 2440 5A6F.tmp 672 5ADC.tmp 1916 5B4A.tmp 2012 5BC6.tmp 2620 5C24.tmp 1928 5C91.tmp 2268 5CEF.tmp 3012 5D4C.tmp 860 5D9A.tmp 328 5E17.tmp 2088 5E94.tmp 1700 5EF2.tmp 2980 5F5F.tmp 1252 5FDC.tmp 2740 6039.tmp 2764 60B6.tmp 2648 6123.tmp 2696 6190.tmp 2732 61EE.tmp 2668 626B.tmp 1220 62B9.tmp -
Loads dropped DLL 64 IoCs
pid Process 3052 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 1252 400C.tmp 2632 40A8.tmp 2648 4135.tmp 2768 41D1.tmp 2668 42DA.tmp 2316 4386.tmp 2832 4422.tmp 2716 44CD.tmp 2536 4569.tmp 2616 4624.tmp 1724 4692.tmp 1564 474D.tmp 2340 47E9.tmp 1304 4866.tmp 1120 4921.tmp 2588 499E.tmp 2828 4A0B.tmp 2896 4A78.tmp 2032 4BA0.tmp 2904 4C3C.tmp 2924 4CB9.tmp 596 4D46.tmp 1968 4E20.tmp 2224 4E7E.tmp 1424 4EEB.tmp 1448 4F48.tmp 2024 4FB6.tmp 1720 5023.tmp 1088 5090.tmp 3000 50DE.tmp 1108 514B.tmp 2332 51A9.tmp 1800 52F0.tmp 1844 5486.tmp 1788 55AE.tmp 2212 560C.tmp 1288 56A8.tmp 2504 5782.tmp 1680 580F.tmp 3020 588C.tmp 1656 58F9.tmp 1600 5976.tmp 1852 59E3.tmp 2440 5A6F.tmp 672 5ADC.tmp 1916 5B4A.tmp 2012 5BC6.tmp 2620 5C24.tmp 1928 5C91.tmp 2268 5CEF.tmp 3012 5D4C.tmp 860 5D9A.tmp 328 5E17.tmp 2088 5E94.tmp 1700 5EF2.tmp 2980 5F5F.tmp 1252 5FDC.tmp 2740 6039.tmp 2764 60B6.tmp 2648 6123.tmp 2696 6190.tmp 2732 61EE.tmp 2668 626B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1252 3052 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 28 PID 3052 wrote to memory of 1252 3052 2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe 28 PID 1252 wrote to memory of 2632 1252 400C.tmp 29 PID 1252 wrote to memory of 2632 1252 400C.tmp 29 PID 1252 wrote to memory of 2632 1252 400C.tmp 29 PID 1252 wrote to memory of 2632 1252 400C.tmp 29 PID 2632 wrote to memory of 2648 2632 40A8.tmp 30 PID 2632 wrote to memory of 2648 2632 40A8.tmp 30 PID 2632 wrote to memory of 2648 2632 40A8.tmp 30 PID 2632 wrote to memory of 2648 2632 40A8.tmp 30 PID 2648 wrote to memory of 2768 2648 4135.tmp 31 PID 2648 wrote to memory of 2768 2648 4135.tmp 31 PID 2648 wrote to memory of 2768 2648 4135.tmp 31 PID 2648 wrote to memory of 2768 2648 4135.tmp 31 PID 2768 wrote to memory of 2668 2768 41D1.tmp 32 PID 2768 wrote to memory of 2668 2768 41D1.tmp 32 PID 2768 wrote to memory of 2668 2768 41D1.tmp 32 PID 2768 wrote to memory of 2668 2768 41D1.tmp 32 PID 2668 wrote to memory of 2316 2668 42DA.tmp 35 PID 2668 wrote to memory of 2316 2668 42DA.tmp 35 PID 2668 wrote to memory of 2316 2668 42DA.tmp 35 PID 2668 wrote to memory of 2316 2668 42DA.tmp 35 PID 2316 wrote to memory of 2832 2316 4386.tmp 33 PID 2316 wrote to memory of 2832 2316 4386.tmp 33 PID 2316 wrote to memory of 2832 2316 4386.tmp 33 PID 2316 wrote to memory of 2832 2316 4386.tmp 33 PID 2832 wrote to memory of 2716 2832 4422.tmp 34 PID 2832 wrote to memory of 2716 2832 4422.tmp 34 PID 2832 wrote to memory of 2716 2832 4422.tmp 34 PID 2832 wrote to memory of 2716 2832 4422.tmp 34 PID 2716 wrote to memory of 2536 2716 44CD.tmp 39 PID 2716 wrote to memory of 2536 2716 44CD.tmp 39 PID 2716 wrote to memory of 2536 2716 44CD.tmp 39 PID 2716 wrote to memory of 2536 2716 44CD.tmp 39 PID 2536 wrote to memory of 2616 2536 4569.tmp 38 PID 2536 wrote to memory of 2616 2536 4569.tmp 38 PID 2536 wrote to memory of 2616 2536 4569.tmp 38 PID 2536 wrote to memory of 2616 2536 4569.tmp 38 PID 2616 wrote to memory of 1724 2616 4624.tmp 36 PID 2616 wrote to memory of 1724 2616 4624.tmp 36 PID 2616 wrote to memory of 1724 2616 4624.tmp 36 PID 2616 wrote to memory of 1724 2616 4624.tmp 36 PID 1724 wrote to memory of 1564 1724 4692.tmp 37 PID 1724 wrote to memory of 1564 1724 4692.tmp 37 PID 1724 wrote to memory of 1564 1724 4692.tmp 37 PID 1724 wrote to memory of 1564 1724 4692.tmp 37 PID 1564 wrote to memory of 2340 1564 474D.tmp 42 PID 1564 wrote to memory of 2340 1564 474D.tmp 42 PID 1564 wrote to memory of 2340 1564 474D.tmp 42 PID 1564 wrote to memory of 2340 1564 474D.tmp 42 PID 2340 wrote to memory of 1304 2340 47E9.tmp 40 PID 2340 wrote to memory of 1304 2340 47E9.tmp 40 PID 2340 wrote to memory of 1304 2340 47E9.tmp 40 PID 2340 wrote to memory of 1304 2340 47E9.tmp 40 PID 1304 wrote to memory of 1120 1304 4866.tmp 41 PID 1304 wrote to memory of 1120 1304 4866.tmp 41 PID 1304 wrote to memory of 1120 1304 4866.tmp 41 PID 1304 wrote to memory of 1120 1304 4866.tmp 41 PID 1120 wrote to memory of 2588 1120 4921.tmp 45 PID 1120 wrote to memory of 2588 1120 4921.tmp 45 PID 1120 wrote to memory of 2588 1120 4921.tmp 45 PID 1120 wrote to memory of 2588 1120 4921.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_38b3c49c511b916aae84963541b7d1fc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\44CD.tmp"C:\Users\Admin\AppData\Local\Temp\44CD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536
-
-
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340
-
-
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588
-
-
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904
-
-
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828
-
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"43⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"44⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"45⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"46⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"47⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"48⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"49⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"50⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"51⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"52⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"53⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"54⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"55⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\692F.tmp"C:\Users\Admin\AppData\Local\Temp\692F.tmp"56⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"57⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"58⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"59⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"60⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"61⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"62⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"63⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"64⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"65⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"66⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"67⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"68⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"69⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"70⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"71⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"72⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"73⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"74⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"75⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"76⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"77⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"78⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"79⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"80⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"81⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"83⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"84⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"85⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"86⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"87⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"88⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"89⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"90⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"91⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"92⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"93⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"94⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"95⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"96⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"97⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"98⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"99⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"100⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"101⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"102⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"103⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"104⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"105⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"106⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"107⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"108⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"109⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"110⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"111⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"113⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"115⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"116⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"117⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"118⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"119⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"120⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"121⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-