Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe
-
Size
541KB
-
MD5
a4d79b815f7f8ff3a0adc21bc6a07952
-
SHA1
7aed256251e6f60120cc8991268161528c47abf5
-
SHA256
0650ca21270eab42f5a3b2dddb00a744674a97f1337e68715b07fe270aa2ca01
-
SHA512
dc1caa588372a917d3fe63ae34cef71f523c57836971978da297be632fa01b6b7a3b810854994965568575595fe99ac016cb46381efd16c2e8e88219895882c7
-
SSDEEP
12288:UU5rCOTeifCstGaE2tyDjIEdKx7KH4q5OTrZa73ctO:UUQOJfWz4E0xeiTrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1040 3EE4.tmp 2536 3FAF.tmp 2700 405A.tmp 2908 4173.tmp 2808 424E.tmp 2916 4309.tmp 2092 43B4.tmp 2900 449E.tmp 2608 45B7.tmp 2460 4692.tmp 2508 477C.tmp 2892 4856.tmp 3056 4940.tmp 2132 4A0B.tmp 2476 4AE5.tmp 2632 4BDF.tmp 2692 4C8A.tmp 756 4D74.tmp 2988 4E3F.tmp 580 4F48.tmp 976 5052.tmp 3068 51F7.tmp 940 52A2.tmp 1668 5310.tmp 1576 539C.tmp 1584 53FA.tmp 2516 5467.tmp 1992 54C4.tmp 1120 5532.tmp 1956 55AE.tmp 1280 561C.tmp 2336 5689.tmp 2524 56F6.tmp 1000 5754.tmp 1784 57C1.tmp 108 584D.tmp 1740 58CA.tmp 2276 5947.tmp 2492 59B4.tmp 328 5A21.tmp 1544 5A9E.tmp 2288 5B3A.tmp 1356 5BD6.tmp 1080 5C43.tmp 1868 5D0E.tmp 908 5D9A.tmp 2304 5E08.tmp 1140 5E84.tmp 1472 5EE2.tmp 576 5F40.tmp 2196 5F9D.tmp 1760 602A.tmp 2428 6087.tmp 1484 60E5.tmp 1596 6142.tmp 2156 61BF.tmp 2164 622C.tmp 1504 62B9.tmp 2704 6316.tmp 2860 6393.tmp 2744 6401.tmp 2720 646E.tmp 2188 64DB.tmp 2800 6548.tmp -
Loads dropped DLL 64 IoCs
pid Process 2480 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 1040 3EE4.tmp 2536 3FAF.tmp 2700 405A.tmp 2908 4173.tmp 2808 424E.tmp 2916 4309.tmp 2092 43B4.tmp 2900 449E.tmp 2608 45B7.tmp 2460 4692.tmp 2508 477C.tmp 2892 4856.tmp 3056 4940.tmp 2132 4A0B.tmp 2476 4AE5.tmp 2632 4BDF.tmp 2692 4C8A.tmp 756 4D74.tmp 2988 4E3F.tmp 580 4F48.tmp 976 5052.tmp 3068 51F7.tmp 940 52A2.tmp 1668 5310.tmp 1576 539C.tmp 1584 53FA.tmp 2516 5467.tmp 1992 54C4.tmp 1120 5532.tmp 1956 55AE.tmp 1280 561C.tmp 2336 5689.tmp 2524 56F6.tmp 1000 5754.tmp 1784 57C1.tmp 108 584D.tmp 1740 58CA.tmp 2276 5947.tmp 2492 59B4.tmp 328 5A21.tmp 1544 5A9E.tmp 2288 5B3A.tmp 1356 5BD6.tmp 1080 5C43.tmp 1868 5D0E.tmp 908 5D9A.tmp 2304 5E08.tmp 1140 5E84.tmp 1472 5EE2.tmp 576 5F40.tmp 2196 5F9D.tmp 1760 602A.tmp 2428 6087.tmp 1484 60E5.tmp 1596 6142.tmp 2156 61BF.tmp 2164 622C.tmp 1504 62B9.tmp 2704 6316.tmp 2860 6393.tmp 2744 6401.tmp 2720 646E.tmp 2188 64DB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 1040 2480 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 28 PID 2480 wrote to memory of 1040 2480 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 28 PID 2480 wrote to memory of 1040 2480 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 28 PID 2480 wrote to memory of 1040 2480 2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe 28 PID 1040 wrote to memory of 2536 1040 3EE4.tmp 29 PID 1040 wrote to memory of 2536 1040 3EE4.tmp 29 PID 1040 wrote to memory of 2536 1040 3EE4.tmp 29 PID 1040 wrote to memory of 2536 1040 3EE4.tmp 29 PID 2536 wrote to memory of 2700 2536 3FAF.tmp 30 PID 2536 wrote to memory of 2700 2536 3FAF.tmp 30 PID 2536 wrote to memory of 2700 2536 3FAF.tmp 30 PID 2536 wrote to memory of 2700 2536 3FAF.tmp 30 PID 2700 wrote to memory of 2908 2700 405A.tmp 31 PID 2700 wrote to memory of 2908 2700 405A.tmp 31 PID 2700 wrote to memory of 2908 2700 405A.tmp 31 PID 2700 wrote to memory of 2908 2700 405A.tmp 31 PID 2908 wrote to memory of 2808 2908 4173.tmp 32 PID 2908 wrote to memory of 2808 2908 4173.tmp 32 PID 2908 wrote to memory of 2808 2908 4173.tmp 32 PID 2908 wrote to memory of 2808 2908 4173.tmp 32 PID 2808 wrote to memory of 2916 2808 424E.tmp 33 PID 2808 wrote to memory of 2916 2808 424E.tmp 33 PID 2808 wrote to memory of 2916 2808 424E.tmp 33 PID 2808 wrote to memory of 2916 2808 424E.tmp 33 PID 2916 wrote to memory of 2092 2916 4309.tmp 34 PID 2916 wrote to memory of 2092 2916 4309.tmp 34 PID 2916 wrote to memory of 2092 2916 4309.tmp 34 PID 2916 wrote to memory of 2092 2916 4309.tmp 34 PID 2092 wrote to memory of 2900 2092 43B4.tmp 35 PID 2092 wrote to memory of 2900 2092 43B4.tmp 35 PID 2092 wrote to memory of 2900 2092 43B4.tmp 35 PID 2092 wrote to memory of 2900 2092 43B4.tmp 35 PID 2900 wrote to memory of 2608 2900 449E.tmp 36 PID 2900 wrote to memory of 2608 2900 449E.tmp 36 PID 2900 wrote to memory of 2608 2900 449E.tmp 36 PID 2900 wrote to memory of 2608 2900 449E.tmp 36 PID 2608 wrote to memory of 2460 2608 45B7.tmp 37 PID 2608 wrote to memory of 2460 2608 45B7.tmp 37 PID 2608 wrote to memory of 2460 2608 45B7.tmp 37 PID 2608 wrote to memory of 2460 2608 45B7.tmp 37 PID 2460 wrote to memory of 2508 2460 4692.tmp 38 PID 2460 wrote to memory of 2508 2460 4692.tmp 38 PID 2460 wrote to memory of 2508 2460 4692.tmp 38 PID 2460 wrote to memory of 2508 2460 4692.tmp 38 PID 2508 wrote to memory of 2892 2508 477C.tmp 39 PID 2508 wrote to memory of 2892 2508 477C.tmp 39 PID 2508 wrote to memory of 2892 2508 477C.tmp 39 PID 2508 wrote to memory of 2892 2508 477C.tmp 39 PID 2892 wrote to memory of 3056 2892 4856.tmp 40 PID 2892 wrote to memory of 3056 2892 4856.tmp 40 PID 2892 wrote to memory of 3056 2892 4856.tmp 40 PID 2892 wrote to memory of 3056 2892 4856.tmp 40 PID 3056 wrote to memory of 2132 3056 4940.tmp 41 PID 3056 wrote to memory of 2132 3056 4940.tmp 41 PID 3056 wrote to memory of 2132 3056 4940.tmp 41 PID 3056 wrote to memory of 2132 3056 4940.tmp 41 PID 2132 wrote to memory of 2476 2132 4A0B.tmp 42 PID 2132 wrote to memory of 2476 2132 4A0B.tmp 42 PID 2132 wrote to memory of 2476 2132 4A0B.tmp 42 PID 2132 wrote to memory of 2476 2132 4A0B.tmp 42 PID 2476 wrote to memory of 2632 2476 4AE5.tmp 43 PID 2476 wrote to memory of 2632 2476 4AE5.tmp 43 PID 2476 wrote to memory of 2632 2476 4AE5.tmp 43 PID 2476 wrote to memory of 2632 2476 4AE5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_a4d79b815f7f8ff3a0adc21bc6a07952_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\5467.tmp"C:\Users\Admin\AppData\Local\Temp\5467.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\561C.tmp"C:\Users\Admin\AppData\Local\Temp\561C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\622C.tmp"C:\Users\Admin\AppData\Local\Temp\622C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\6316.tmp"C:\Users\Admin\AppData\Local\Temp\6316.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"65⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"67⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"68⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"69⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"70⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"71⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"72⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"73⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"74⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"76⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"77⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"78⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"79⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"80⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"81⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"82⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6D92.tmp"C:\Users\Admin\AppData\Local\Temp\6D92.tmp"83⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"84⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"85⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"86⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"87⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"88⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"89⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"90⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"91⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"93⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"94⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"95⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\737B.tmp"C:\Users\Admin\AppData\Local\Temp\737B.tmp"96⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\73F8.tmp"C:\Users\Admin\AppData\Local\Temp\73F8.tmp"97⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"98⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"99⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"100⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"101⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"102⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"103⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"104⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"105⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"106⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"107⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"108⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"109⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"110⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"111⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"112⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"113⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"114⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"115⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"116⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"117⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"118⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"119⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"120⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"121⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"122⤵PID:284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-