Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe
-
Size
486KB
-
MD5
4ab7dbf782e762c0e6619fc80c213407
-
SHA1
158843ee7bcf1123d9621dc251b963a5a8ded32c
-
SHA256
1ad4c6be91a2848f5a7cacf3aa5454ce4f248be41f8291b390cf29b3b8f5cded
-
SHA512
99638fb7ddbd1740d35252c023d25154b613d9b20a3880737a04216374aae67757a306437eda78fe8e9fc882dd96c0fb1c1069e25e5c0de60970bef40c46b0bd
-
SSDEEP
12288:oU5rCOTeiDCmTc4ncIL9rii+AREsm0rTkeg22SEANZ:oUQOJDCmY41IrARZrTken5N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2760 51C8.tmp 2420 5283.tmp 2776 536D.tmp 2780 5448.tmp 2756 5532.tmp 2732 55ED.tmp 1484 56A8.tmp 1712 57A2.tmp 2588 589B.tmp 2488 59A4.tmp 3064 5A50.tmp 2236 5B4A.tmp 540 5C43.tmp 2852 5D2D.tmp 2896 5E27.tmp 2612 5EF2.tmp 1652 5FBC.tmp 2020 6039.tmp 2032 6133.tmp 2484 624C.tmp 2640 62E8.tmp 1644 64AC.tmp 2912 6596.tmp 1480 6613.tmp 1624 6680.tmp 1608 670D.tmp 1728 6789.tmp 2340 6806.tmp 2396 6883.tmp 2752 6900.tmp 2328 697D.tmp 2160 69F9.tmp 1696 6A67.tmp 616 6AE3.tmp 1920 6B60.tmp 400 6BED.tmp 2280 6C79.tmp 1096 6D05.tmp 924 6D63.tmp 1772 6DE0.tmp 1672 6E4D.tmp 1344 6EBA.tmp 1268 6F37.tmp 1840 6F95.tmp 1640 7011.tmp 1008 708E.tmp 1560 70FB.tmp 2040 7178.tmp 532 7205.tmp 3020 7272.tmp 2104 72EF.tmp 1524 735C.tmp 2000 73D9.tmp 2212 7446.tmp 1580 74B3.tmp 2508 7520.tmp 2664 759D.tmp 2760 760A.tmp 2700 7687.tmp 2828 76F4.tmp 2784 7781.tmp 2800 77FD.tmp 2704 787A.tmp 2824 7955.tmp -
Loads dropped DLL 64 IoCs
pid Process 2096 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 2760 51C8.tmp 2420 5283.tmp 2776 536D.tmp 2780 5448.tmp 2756 5532.tmp 2732 55ED.tmp 1484 56A8.tmp 1712 57A2.tmp 2588 589B.tmp 2488 59A4.tmp 3064 5A50.tmp 2236 5B4A.tmp 540 5C43.tmp 2852 5D2D.tmp 2896 5E27.tmp 2612 5EF2.tmp 1652 5FBC.tmp 2020 6039.tmp 2032 6133.tmp 2484 624C.tmp 2640 62E8.tmp 1644 64AC.tmp 2912 6596.tmp 1480 6613.tmp 1624 6680.tmp 1608 670D.tmp 1728 6789.tmp 2340 6806.tmp 2396 6883.tmp 2752 6900.tmp 2328 697D.tmp 2160 69F9.tmp 1696 6A67.tmp 616 6AE3.tmp 1920 6B60.tmp 400 6BED.tmp 2280 6C79.tmp 1096 6D05.tmp 924 6D63.tmp 1772 6DE0.tmp 1672 6E4D.tmp 1344 6EBA.tmp 1268 6F37.tmp 1840 6F95.tmp 1640 7011.tmp 1008 708E.tmp 1560 70FB.tmp 2040 7178.tmp 532 7205.tmp 3020 7272.tmp 2104 72EF.tmp 1524 735C.tmp 2000 73D9.tmp 2212 7446.tmp 1580 74B3.tmp 2508 7520.tmp 2664 759D.tmp 2760 760A.tmp 2700 7687.tmp 2828 76F4.tmp 2784 7781.tmp 2800 77FD.tmp 2704 787A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2760 2096 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 28 PID 2096 wrote to memory of 2760 2096 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 28 PID 2096 wrote to memory of 2760 2096 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 28 PID 2096 wrote to memory of 2760 2096 2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe 28 PID 2760 wrote to memory of 2420 2760 51C8.tmp 29 PID 2760 wrote to memory of 2420 2760 51C8.tmp 29 PID 2760 wrote to memory of 2420 2760 51C8.tmp 29 PID 2760 wrote to memory of 2420 2760 51C8.tmp 29 PID 2420 wrote to memory of 2776 2420 5283.tmp 30 PID 2420 wrote to memory of 2776 2420 5283.tmp 30 PID 2420 wrote to memory of 2776 2420 5283.tmp 30 PID 2420 wrote to memory of 2776 2420 5283.tmp 30 PID 2776 wrote to memory of 2780 2776 536D.tmp 31 PID 2776 wrote to memory of 2780 2776 536D.tmp 31 PID 2776 wrote to memory of 2780 2776 536D.tmp 31 PID 2776 wrote to memory of 2780 2776 536D.tmp 31 PID 2780 wrote to memory of 2756 2780 5448.tmp 32 PID 2780 wrote to memory of 2756 2780 5448.tmp 32 PID 2780 wrote to memory of 2756 2780 5448.tmp 32 PID 2780 wrote to memory of 2756 2780 5448.tmp 32 PID 2756 wrote to memory of 2732 2756 5532.tmp 33 PID 2756 wrote to memory of 2732 2756 5532.tmp 33 PID 2756 wrote to memory of 2732 2756 5532.tmp 33 PID 2756 wrote to memory of 2732 2756 5532.tmp 33 PID 2732 wrote to memory of 1484 2732 55ED.tmp 34 PID 2732 wrote to memory of 1484 2732 55ED.tmp 34 PID 2732 wrote to memory of 1484 2732 55ED.tmp 34 PID 2732 wrote to memory of 1484 2732 55ED.tmp 34 PID 1484 wrote to memory of 1712 1484 56A8.tmp 35 PID 1484 wrote to memory of 1712 1484 56A8.tmp 35 PID 1484 wrote to memory of 1712 1484 56A8.tmp 35 PID 1484 wrote to memory of 1712 1484 56A8.tmp 35 PID 1712 wrote to memory of 2588 1712 57A2.tmp 36 PID 1712 wrote to memory of 2588 1712 57A2.tmp 36 PID 1712 wrote to memory of 2588 1712 57A2.tmp 36 PID 1712 wrote to memory of 2588 1712 57A2.tmp 36 PID 2588 wrote to memory of 2488 2588 589B.tmp 37 PID 2588 wrote to memory of 2488 2588 589B.tmp 37 PID 2588 wrote to memory of 2488 2588 589B.tmp 37 PID 2588 wrote to memory of 2488 2588 589B.tmp 37 PID 2488 wrote to memory of 3064 2488 59A4.tmp 38 PID 2488 wrote to memory of 3064 2488 59A4.tmp 38 PID 2488 wrote to memory of 3064 2488 59A4.tmp 38 PID 2488 wrote to memory of 3064 2488 59A4.tmp 38 PID 3064 wrote to memory of 2236 3064 5A50.tmp 39 PID 3064 wrote to memory of 2236 3064 5A50.tmp 39 PID 3064 wrote to memory of 2236 3064 5A50.tmp 39 PID 3064 wrote to memory of 2236 3064 5A50.tmp 39 PID 2236 wrote to memory of 540 2236 5B4A.tmp 40 PID 2236 wrote to memory of 540 2236 5B4A.tmp 40 PID 2236 wrote to memory of 540 2236 5B4A.tmp 40 PID 2236 wrote to memory of 540 2236 5B4A.tmp 40 PID 540 wrote to memory of 2852 540 5C43.tmp 41 PID 540 wrote to memory of 2852 540 5C43.tmp 41 PID 540 wrote to memory of 2852 540 5C43.tmp 41 PID 540 wrote to memory of 2852 540 5C43.tmp 41 PID 2852 wrote to memory of 2896 2852 5D2D.tmp 42 PID 2852 wrote to memory of 2896 2852 5D2D.tmp 42 PID 2852 wrote to memory of 2896 2852 5D2D.tmp 42 PID 2852 wrote to memory of 2896 2852 5D2D.tmp 42 PID 2896 wrote to memory of 2612 2896 5E27.tmp 43 PID 2896 wrote to memory of 2612 2896 5E27.tmp 43 PID 2896 wrote to memory of 2612 2896 5E27.tmp 43 PID 2896 wrote to memory of 2612 2896 5E27.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_4ab7dbf782e762c0e6619fc80c213407_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\57A2.tmp"C:\Users\Admin\AppData\Local\Temp\57A2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\7011.tmp"C:\Users\Admin\AppData\Local\Temp\7011.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\7687.tmp"C:\Users\Admin\AppData\Local\Temp\7687.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"66⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"67⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"68⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"69⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"70⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"71⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"72⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"73⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"74⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"75⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"76⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"77⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"78⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"79⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"80⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"81⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"82⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"83⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"84⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"85⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"86⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"87⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"89⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"90⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"91⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"92⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"93⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"94⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"95⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"96⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"97⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"98⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\88CF.tmp"C:\Users\Admin\AppData\Local\Temp\88CF.tmp"99⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"100⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"102⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"104⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"105⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"106⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"107⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"108⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"109⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"110⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"111⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"112⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"113⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"114⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"115⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\90EA.tmp"C:\Users\Admin\AppData\Local\Temp\90EA.tmp"116⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"117⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"118⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"119⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"120⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"121⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"122⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-