Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe
-
Size
486KB
-
MD5
bae2b8bc88b1338e42f353ad45e19dea
-
SHA1
46577b5bee3e004dc137166e5f1693f5497db245
-
SHA256
fb9190cdd42c69e1a01547f1f4c05be4851081bb449aa6c202fcf413ece6a1d3
-
SHA512
f97f6d7d730c5393a734e84418c1e1b145f04de0c537e3b2da8343d242e4e2d6c3379b0e747023f8a8edb89b726ce50c966f598b4b6fcdcc248f97941cf43ed3
-
SSDEEP
12288:/U5rCOTeiD1mHrH1agWuTV4zOnw+xHot0eNZ:/UQOJD1mfWuZ4zOnw+dozN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2584 4431.tmp 1116 448F.tmp 2408 4569.tmp 2444 4634.tmp 2476 471E.tmp 2876 47D9.tmp 2784 48A4.tmp 2324 495F.tmp 2668 4A1A.tmp 2804 4B04.tmp 2688 4BC0.tmp 2664 4C6B.tmp 2232 4D07.tmp 2224 4DD2.tmp 520 4E7E.tmp 984 4F1A.tmp 2928 4FD5.tmp 2836 50A0.tmp 2968 514B.tmp 1064 5206.tmp 1408 52A2.tmp 1400 537D.tmp 2972 5428.tmp 1908 54A5.tmp 1920 5512.tmp 1380 559F.tmp 3064 5679.tmp 2220 56E6.tmp 2116 5754.tmp 2132 57C1.tmp 2044 583E.tmp 1744 58AB.tmp 1988 5928.tmp 832 59A4.tmp 1252 5A12.tmp 1156 5A7F.tmp 1676 5ADC.tmp 2128 5B4A.tmp 1880 5BB7.tmp 1964 5C24.tmp 1528 5C82.tmp 976 5CDF.tmp 1776 5D4C.tmp 1124 5DC9.tmp 1012 5E27.tmp 688 5EA4.tmp 1668 5F01.tmp 2272 5F7E.tmp 2568 5FCC.tmp 2480 6049.tmp 2296 60A6.tmp 1604 6114.tmp 2316 6181.tmp 2588 61FE.tmp 2312 62B9.tmp 2432 6326.tmp 2524 6384.tmp 1116 63F1.tmp 2776 646E.tmp 800 64DB.tmp 2464 6558.tmp 2424 65B5.tmp 2940 6623.tmp 2856 6690.tmp -
Loads dropped DLL 64 IoCs
pid Process 2292 2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe 2584 4431.tmp 1116 448F.tmp 2408 4569.tmp 2444 4634.tmp 2476 471E.tmp 2876 47D9.tmp 2784 48A4.tmp 2324 495F.tmp 2668 4A1A.tmp 2804 4B04.tmp 2688 4BC0.tmp 2664 4C6B.tmp 2232 4D07.tmp 2224 4DD2.tmp 520 4E7E.tmp 984 4F1A.tmp 2928 4FD5.tmp 2836 50A0.tmp 2968 514B.tmp 1064 5206.tmp 1408 52A2.tmp 1400 537D.tmp 2972 5428.tmp 1908 54A5.tmp 1920 5512.tmp 1380 559F.tmp 3064 5679.tmp 2220 56E6.tmp 2116 5754.tmp 2132 57C1.tmp 2044 583E.tmp 1744 58AB.tmp 1988 5928.tmp 832 59A4.tmp 1252 5A12.tmp 1156 5A7F.tmp 1676 5ADC.tmp 2128 5B4A.tmp 1880 5BB7.tmp 1964 5C24.tmp 1528 5C82.tmp 976 5CDF.tmp 1776 5D4C.tmp 1124 5DC9.tmp 1012 5E27.tmp 688 5EA4.tmp 1668 5F01.tmp 2272 5F7E.tmp 2568 5FCC.tmp 2480 6049.tmp 2296 60A6.tmp 1604 6114.tmp 2316 6181.tmp 1592 626B.tmp 2312 62B9.tmp 2432 6326.tmp 2524 6384.tmp 1116 63F1.tmp 2776 646E.tmp 800 64DB.tmp 2464 6558.tmp 2424 65B5.tmp 2940 6623.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2584 2292 2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe 28 PID 2292 wrote to memory of 2584 2292 2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe 28 PID 2292 wrote to memory of 2584 2292 2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe 28 PID 2292 wrote to memory of 2584 2292 2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe 28 PID 2584 wrote to memory of 1116 2584 4431.tmp 29 PID 2584 wrote to memory of 1116 2584 4431.tmp 29 PID 2584 wrote to memory of 1116 2584 4431.tmp 29 PID 2584 wrote to memory of 1116 2584 4431.tmp 29 PID 1116 wrote to memory of 2408 1116 448F.tmp 30 PID 1116 wrote to memory of 2408 1116 448F.tmp 30 PID 1116 wrote to memory of 2408 1116 448F.tmp 30 PID 1116 wrote to memory of 2408 1116 448F.tmp 30 PID 2408 wrote to memory of 2444 2408 4569.tmp 31 PID 2408 wrote to memory of 2444 2408 4569.tmp 31 PID 2408 wrote to memory of 2444 2408 4569.tmp 31 PID 2408 wrote to memory of 2444 2408 4569.tmp 31 PID 2444 wrote to memory of 2476 2444 4634.tmp 32 PID 2444 wrote to memory of 2476 2444 4634.tmp 32 PID 2444 wrote to memory of 2476 2444 4634.tmp 32 PID 2444 wrote to memory of 2476 2444 4634.tmp 32 PID 2476 wrote to memory of 2876 2476 471E.tmp 33 PID 2476 wrote to memory of 2876 2476 471E.tmp 33 PID 2476 wrote to memory of 2876 2476 471E.tmp 33 PID 2476 wrote to memory of 2876 2476 471E.tmp 33 PID 2876 wrote to memory of 2784 2876 47D9.tmp 34 PID 2876 wrote to memory of 2784 2876 47D9.tmp 34 PID 2876 wrote to memory of 2784 2876 47D9.tmp 34 PID 2876 wrote to memory of 2784 2876 47D9.tmp 34 PID 2784 wrote to memory of 2324 2784 48A4.tmp 35 PID 2784 wrote to memory of 2324 2784 48A4.tmp 35 PID 2784 wrote to memory of 2324 2784 48A4.tmp 35 PID 2784 wrote to memory of 2324 2784 48A4.tmp 35 PID 2324 wrote to memory of 2668 2324 495F.tmp 36 PID 2324 wrote to memory of 2668 2324 495F.tmp 36 PID 2324 wrote to memory of 2668 2324 495F.tmp 36 PID 2324 wrote to memory of 2668 2324 495F.tmp 36 PID 2668 wrote to memory of 2804 2668 4A1A.tmp 37 PID 2668 wrote to memory of 2804 2668 4A1A.tmp 37 PID 2668 wrote to memory of 2804 2668 4A1A.tmp 37 PID 2668 wrote to memory of 2804 2668 4A1A.tmp 37 PID 2804 wrote to memory of 2688 2804 4B04.tmp 38 PID 2804 wrote to memory of 2688 2804 4B04.tmp 38 PID 2804 wrote to memory of 2688 2804 4B04.tmp 38 PID 2804 wrote to memory of 2688 2804 4B04.tmp 38 PID 2688 wrote to memory of 2664 2688 4BC0.tmp 39 PID 2688 wrote to memory of 2664 2688 4BC0.tmp 39 PID 2688 wrote to memory of 2664 2688 4BC0.tmp 39 PID 2688 wrote to memory of 2664 2688 4BC0.tmp 39 PID 2664 wrote to memory of 2232 2664 4C6B.tmp 40 PID 2664 wrote to memory of 2232 2664 4C6B.tmp 40 PID 2664 wrote to memory of 2232 2664 4C6B.tmp 40 PID 2664 wrote to memory of 2232 2664 4C6B.tmp 40 PID 2232 wrote to memory of 2224 2232 4D07.tmp 41 PID 2232 wrote to memory of 2224 2232 4D07.tmp 41 PID 2232 wrote to memory of 2224 2232 4D07.tmp 41 PID 2232 wrote to memory of 2224 2232 4D07.tmp 41 PID 2224 wrote to memory of 520 2224 4DD2.tmp 42 PID 2224 wrote to memory of 520 2224 4DD2.tmp 42 PID 2224 wrote to memory of 520 2224 4DD2.tmp 42 PID 2224 wrote to memory of 520 2224 4DD2.tmp 42 PID 520 wrote to memory of 984 520 4E7E.tmp 43 PID 520 wrote to memory of 984 520 4E7E.tmp 43 PID 520 wrote to memory of 984 520 4E7E.tmp 43 PID 520 wrote to memory of 984 520 4E7E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_bae2b8bc88b1338e42f353ad45e19dea_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\47D9.tmp"C:\Users\Admin\AppData\Local\Temp\47D9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\54A5.tmp"C:\Users\Admin\AppData\Local\Temp\54A5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"C:\Users\Admin\AppData\Local\Temp\5CDF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"C:\Users\Admin\AppData\Local\Temp\5D4C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"55⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"56⤵
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"66⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"68⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"69⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"70⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"71⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"72⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"73⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"74⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"C:\Users\Admin\AppData\Local\Temp\6AF3.tmp"75⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"76⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"77⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"78⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"79⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"80⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"81⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"83⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"84⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6F85.tmp"C:\Users\Admin\AppData\Local\Temp\6F85.tmp"85⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"86⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"87⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"88⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"89⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"90⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"91⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"92⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"93⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"94⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"95⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"96⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"97⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"98⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"100⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"101⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"102⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"103⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"104⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"105⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"106⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"107⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"108⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"109⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"110⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"111⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"112⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"113⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"114⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"115⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"116⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"117⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"118⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"119⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"120⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"121⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"122⤵PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-