Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 17:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe
-
Size
486KB
-
MD5
a9dd47c4661e360b324376eafccf04f8
-
SHA1
71e04130d2a88b77d06fc6a9e555fd5b7220aac9
-
SHA256
4ab65078cebb84f797bffe9f20be7efeb7619bdb3fc581d7a4e228742f113aea
-
SHA512
d70919219c8f25a0eac2f40fcba09a9ebdb03f16a121330193de10636993594955741b18bd70505adbc75ce24fef6fa1ab70015e40e891be9d9818a3807ee98c
-
SSDEEP
12288:/U5rCOTeiDYgUk4GcpFuLE/kCw0O2CpMXpi8NZ:/UQOJDhT4GcHuLE/U0BYoi8N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1736 4402.tmp 1712 44AE.tmp 2188 45C7.tmp 2512 4672.tmp 2860 475C.tmp 2540 4818.tmp 2408 48A4.tmp 2392 496F.tmp 2420 4A3A.tmp 2544 4AE5.tmp 2316 4BB0.tmp 2292 4C6B.tmp 2744 4D17.tmp 1996 4DC2.tmp 2476 4E9D.tmp 472 4F39.tmp 1284 4F96.tmp 2224 5042.tmp 632 50FD.tmp 1900 51C8.tmp 1704 5245.tmp 1492 52F0.tmp 1116 537D.tmp 2436 53DA.tmp 1612 5448.tmp 1588 54C4.tmp 1364 5541.tmp 516 55FC.tmp 2732 566A.tmp 2644 56C7.tmp 1720 5734.tmp 2984 57C1.tmp 1448 582E.tmp 2932 589B.tmp 1932 5908.tmp 1508 5985.tmp 396 59E3.tmp 2700 5A31.tmp 1152 5ABD.tmp 1420 5B2A.tmp 2148 5BA7.tmp 764 5C24.tmp 952 5C91.tmp 3004 5D1E.tmp 292 5D8B.tmp 892 5DE8.tmp 2976 5E36.tmp 3008 5EA4.tmp 2728 5F01.tmp 2904 5F7E.tmp 1880 5FFB.tmp 344 6068.tmp 1504 60E5.tmp 3028 6152.tmp 2116 61CF.tmp 1600 624C.tmp 2100 62B9.tmp 1736 6336.tmp 1620 63B3.tmp 1700 643F.tmp 2864 64AC.tmp 2920 6519.tmp 2388 6596.tmp 2536 6603.tmp -
Loads dropped DLL 64 IoCs
pid Process 2100 2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe 1736 4402.tmp 1712 44AE.tmp 2188 45C7.tmp 2512 4672.tmp 2860 475C.tmp 2540 4818.tmp 2408 48A4.tmp 2392 496F.tmp 2420 4A3A.tmp 2544 4AE5.tmp 2316 4BB0.tmp 2292 4C6B.tmp 2744 4D17.tmp 1996 4DC2.tmp 2476 4E9D.tmp 472 4F39.tmp 1284 4F96.tmp 2224 5042.tmp 632 50FD.tmp 1900 51C8.tmp 1704 5245.tmp 1492 52F0.tmp 1116 537D.tmp 2436 53DA.tmp 1612 5448.tmp 1588 54C4.tmp 1364 5541.tmp 516 55FC.tmp 2732 566A.tmp 2644 56C7.tmp 1720 5734.tmp 2984 57C1.tmp 1448 582E.tmp 2932 589B.tmp 1932 5908.tmp 1508 5985.tmp 396 59E3.tmp 2700 5A31.tmp 1152 5ABD.tmp 1420 5B2A.tmp 2148 5BA7.tmp 764 5C24.tmp 952 5C91.tmp 3004 5D1E.tmp 292 5D8B.tmp 892 5DE8.tmp 2976 5E36.tmp 3008 5EA4.tmp 2728 5F01.tmp 2904 5F7E.tmp 1880 5FFB.tmp 344 6068.tmp 1504 60E5.tmp 3028 6152.tmp 2116 61CF.tmp 1600 624C.tmp 2100 62B9.tmp 1736 6336.tmp 1620 63B3.tmp 1700 643F.tmp 2864 64AC.tmp 2920 6519.tmp 2388 6596.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 1736 2100 2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe 28 PID 2100 wrote to memory of 1736 2100 2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe 28 PID 2100 wrote to memory of 1736 2100 2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe 28 PID 2100 wrote to memory of 1736 2100 2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe 28 PID 1736 wrote to memory of 1712 1736 4402.tmp 29 PID 1736 wrote to memory of 1712 1736 4402.tmp 29 PID 1736 wrote to memory of 1712 1736 4402.tmp 29 PID 1736 wrote to memory of 1712 1736 4402.tmp 29 PID 1712 wrote to memory of 2188 1712 44AE.tmp 30 PID 1712 wrote to memory of 2188 1712 44AE.tmp 30 PID 1712 wrote to memory of 2188 1712 44AE.tmp 30 PID 1712 wrote to memory of 2188 1712 44AE.tmp 30 PID 2188 wrote to memory of 2512 2188 45C7.tmp 31 PID 2188 wrote to memory of 2512 2188 45C7.tmp 31 PID 2188 wrote to memory of 2512 2188 45C7.tmp 31 PID 2188 wrote to memory of 2512 2188 45C7.tmp 31 PID 2512 wrote to memory of 2860 2512 4672.tmp 32 PID 2512 wrote to memory of 2860 2512 4672.tmp 32 PID 2512 wrote to memory of 2860 2512 4672.tmp 32 PID 2512 wrote to memory of 2860 2512 4672.tmp 32 PID 2860 wrote to memory of 2540 2860 475C.tmp 33 PID 2860 wrote to memory of 2540 2860 475C.tmp 33 PID 2860 wrote to memory of 2540 2860 475C.tmp 33 PID 2860 wrote to memory of 2540 2860 475C.tmp 33 PID 2540 wrote to memory of 2408 2540 4818.tmp 34 PID 2540 wrote to memory of 2408 2540 4818.tmp 34 PID 2540 wrote to memory of 2408 2540 4818.tmp 34 PID 2540 wrote to memory of 2408 2540 4818.tmp 34 PID 2408 wrote to memory of 2392 2408 48A4.tmp 35 PID 2408 wrote to memory of 2392 2408 48A4.tmp 35 PID 2408 wrote to memory of 2392 2408 48A4.tmp 35 PID 2408 wrote to memory of 2392 2408 48A4.tmp 35 PID 2392 wrote to memory of 2420 2392 496F.tmp 36 PID 2392 wrote to memory of 2420 2392 496F.tmp 36 PID 2392 wrote to memory of 2420 2392 496F.tmp 36 PID 2392 wrote to memory of 2420 2392 496F.tmp 36 PID 2420 wrote to memory of 2544 2420 4A3A.tmp 37 PID 2420 wrote to memory of 2544 2420 4A3A.tmp 37 PID 2420 wrote to memory of 2544 2420 4A3A.tmp 37 PID 2420 wrote to memory of 2544 2420 4A3A.tmp 37 PID 2544 wrote to memory of 2316 2544 4AE5.tmp 38 PID 2544 wrote to memory of 2316 2544 4AE5.tmp 38 PID 2544 wrote to memory of 2316 2544 4AE5.tmp 38 PID 2544 wrote to memory of 2316 2544 4AE5.tmp 38 PID 2316 wrote to memory of 2292 2316 4BB0.tmp 39 PID 2316 wrote to memory of 2292 2316 4BB0.tmp 39 PID 2316 wrote to memory of 2292 2316 4BB0.tmp 39 PID 2316 wrote to memory of 2292 2316 4BB0.tmp 39 PID 2292 wrote to memory of 2744 2292 4C6B.tmp 40 PID 2292 wrote to memory of 2744 2292 4C6B.tmp 40 PID 2292 wrote to memory of 2744 2292 4C6B.tmp 40 PID 2292 wrote to memory of 2744 2292 4C6B.tmp 40 PID 2744 wrote to memory of 1996 2744 4D17.tmp 41 PID 2744 wrote to memory of 1996 2744 4D17.tmp 41 PID 2744 wrote to memory of 1996 2744 4D17.tmp 41 PID 2744 wrote to memory of 1996 2744 4D17.tmp 41 PID 1996 wrote to memory of 2476 1996 4DC2.tmp 42 PID 1996 wrote to memory of 2476 1996 4DC2.tmp 42 PID 1996 wrote to memory of 2476 1996 4DC2.tmp 42 PID 1996 wrote to memory of 2476 1996 4DC2.tmp 42 PID 2476 wrote to memory of 472 2476 4E9D.tmp 43 PID 2476 wrote to memory of 472 2476 4E9D.tmp 43 PID 2476 wrote to memory of 472 2476 4E9D.tmp 43 PID 2476 wrote to memory of 472 2476 4E9D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-27_a9dd47c4661e360b324376eafccf04f8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:516 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"C:\Users\Admin\AppData\Local\Temp\5B2A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6336.tmp"C:\Users\Admin\AppData\Local\Temp\6336.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\64AC.tmp"C:\Users\Admin\AppData\Local\Temp\64AC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"65⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"67⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"69⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"70⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"71⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"72⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"73⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"74⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"75⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"77⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"78⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"79⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"80⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"81⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"82⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"83⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"84⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"85⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"86⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"87⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"88⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"89⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"90⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"91⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"92⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"93⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"94⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"95⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"96⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"97⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"98⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"99⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"100⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"101⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"102⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"103⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"104⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"106⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"107⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"108⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"109⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"110⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"112⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"113⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"114⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7C80.tmp"C:\Users\Admin\AppData\Local\Temp\7C80.tmp"115⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"116⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"118⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"119⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"120⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"121⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-