Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 06:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe
-
Size
488KB
-
MD5
4aa2def1f11ae6988836774b4149567e
-
SHA1
20525535e3067d207e74da4d76324fc0045b1b00
-
SHA256
4673e7294caabc1c6ded9b649dd342f94c3610db4f4b605366e086593a6f2efd
-
SHA512
b0610179163f86b853634f66cf40f166012fe4e57a84cd169cfec4f092335744d4d4c0fd90ffaa8025f204acece3f9c24d06edb6a30dac3cf39b91859737e2b6
-
SSDEEP
12288:/U5rCOTeiD9a1vxuZW68NPtRvz9W7W78/NZ:/UQOJD90gx0jQ/N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2916 5419.tmp 2780 5476.tmp 3016 5560.tmp 2596 5698.tmp 2504 5725.tmp 2556 580F.tmp 2512 58F9.tmp 2548 59D3.tmp 1672 5A6F.tmp 2368 5B3A.tmp 2264 5BD6.tmp 2036 5CB0.tmp 1524 5D5C.tmp 436 5E46.tmp 1484 5F11.tmp 2732 5FEB.tmp 2752 6087.tmp 2452 6171.tmp 2188 621D.tmp 2260 62F7.tmp 1476 63C2.tmp 548 649D.tmp 2668 6558.tmp 1712 6623.tmp 1356 675B.tmp 1360 6816.tmp 1804 68A2.tmp 1940 691F.tmp 1920 698C.tmp 2800 6A19.tmp 1092 6A95.tmp 2052 6B03.tmp 2256 6B60.tmp 2076 6BDD.tmp 2132 6C69.tmp 1900 6CF6.tmp 2012 6D53.tmp 1012 6DE0.tmp 1908 6E5D.tmp 816 6EE9.tmp 1296 6F66.tmp 2168 6FE3.tmp 364 705F.tmp 884 70BD.tmp 1624 7149.tmp 1028 71C6.tmp 2064 7214.tmp 1796 7291.tmp 3064 72FE.tmp 2000 736B.tmp 1444 73D9.tmp 2148 7436.tmp 3020 74B3.tmp 2908 7530.tmp 1696 75BC.tmp 2432 7629.tmp 1732 76A6.tmp 2084 7713.tmp 2936 7781.tmp 2580 77EE.tmp 2572 786B.tmp 2596 78D8.tmp 2608 7935.tmp 2604 79A3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2852 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 2916 5419.tmp 2780 5476.tmp 3016 5560.tmp 2596 5698.tmp 2504 5725.tmp 2556 580F.tmp 2512 58F9.tmp 2548 59D3.tmp 1672 5A6F.tmp 2368 5B3A.tmp 2264 5BD6.tmp 2036 5CB0.tmp 1524 5D5C.tmp 436 5E46.tmp 1484 5F11.tmp 2732 5FEB.tmp 2752 6087.tmp 2452 6171.tmp 2188 621D.tmp 2260 62F7.tmp 1476 63C2.tmp 548 649D.tmp 2668 6558.tmp 1712 6623.tmp 1356 675B.tmp 1360 6816.tmp 1804 68A2.tmp 1940 691F.tmp 1920 698C.tmp 2800 6A19.tmp 1092 6A95.tmp 2052 6B03.tmp 2256 6B60.tmp 2076 6BDD.tmp 2132 6C69.tmp 1900 6CF6.tmp 2012 6D53.tmp 1012 6DE0.tmp 1908 6E5D.tmp 816 6EE9.tmp 1296 6F66.tmp 2168 6FE3.tmp 364 705F.tmp 884 70BD.tmp 1624 7149.tmp 1028 71C6.tmp 2064 7214.tmp 1796 7291.tmp 3064 72FE.tmp 2000 736B.tmp 1444 73D9.tmp 2148 7436.tmp 3020 74B3.tmp 2908 7530.tmp 1696 75BC.tmp 2432 7629.tmp 1732 76A6.tmp 2084 7713.tmp 2936 7781.tmp 2580 77EE.tmp 2572 786B.tmp 2596 78D8.tmp 2608 7935.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2916 2852 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 28 PID 2852 wrote to memory of 2916 2852 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 28 PID 2852 wrote to memory of 2916 2852 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 28 PID 2852 wrote to memory of 2916 2852 2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe 28 PID 2916 wrote to memory of 2780 2916 5419.tmp 29 PID 2916 wrote to memory of 2780 2916 5419.tmp 29 PID 2916 wrote to memory of 2780 2916 5419.tmp 29 PID 2916 wrote to memory of 2780 2916 5419.tmp 29 PID 2780 wrote to memory of 3016 2780 5476.tmp 30 PID 2780 wrote to memory of 3016 2780 5476.tmp 30 PID 2780 wrote to memory of 3016 2780 5476.tmp 30 PID 2780 wrote to memory of 3016 2780 5476.tmp 30 PID 3016 wrote to memory of 2596 3016 5560.tmp 31 PID 3016 wrote to memory of 2596 3016 5560.tmp 31 PID 3016 wrote to memory of 2596 3016 5560.tmp 31 PID 3016 wrote to memory of 2596 3016 5560.tmp 31 PID 2596 wrote to memory of 2504 2596 5698.tmp 32 PID 2596 wrote to memory of 2504 2596 5698.tmp 32 PID 2596 wrote to memory of 2504 2596 5698.tmp 32 PID 2596 wrote to memory of 2504 2596 5698.tmp 32 PID 2504 wrote to memory of 2556 2504 5725.tmp 33 PID 2504 wrote to memory of 2556 2504 5725.tmp 33 PID 2504 wrote to memory of 2556 2504 5725.tmp 33 PID 2504 wrote to memory of 2556 2504 5725.tmp 33 PID 2556 wrote to memory of 2512 2556 580F.tmp 34 PID 2556 wrote to memory of 2512 2556 580F.tmp 34 PID 2556 wrote to memory of 2512 2556 580F.tmp 34 PID 2556 wrote to memory of 2512 2556 580F.tmp 34 PID 2512 wrote to memory of 2548 2512 58F9.tmp 35 PID 2512 wrote to memory of 2548 2512 58F9.tmp 35 PID 2512 wrote to memory of 2548 2512 58F9.tmp 35 PID 2512 wrote to memory of 2548 2512 58F9.tmp 35 PID 2548 wrote to memory of 1672 2548 59D3.tmp 36 PID 2548 wrote to memory of 1672 2548 59D3.tmp 36 PID 2548 wrote to memory of 1672 2548 59D3.tmp 36 PID 2548 wrote to memory of 1672 2548 59D3.tmp 36 PID 1672 wrote to memory of 2368 1672 5A6F.tmp 37 PID 1672 wrote to memory of 2368 1672 5A6F.tmp 37 PID 1672 wrote to memory of 2368 1672 5A6F.tmp 37 PID 1672 wrote to memory of 2368 1672 5A6F.tmp 37 PID 2368 wrote to memory of 2264 2368 5B3A.tmp 38 PID 2368 wrote to memory of 2264 2368 5B3A.tmp 38 PID 2368 wrote to memory of 2264 2368 5B3A.tmp 38 PID 2368 wrote to memory of 2264 2368 5B3A.tmp 38 PID 2264 wrote to memory of 2036 2264 5BD6.tmp 39 PID 2264 wrote to memory of 2036 2264 5BD6.tmp 39 PID 2264 wrote to memory of 2036 2264 5BD6.tmp 39 PID 2264 wrote to memory of 2036 2264 5BD6.tmp 39 PID 2036 wrote to memory of 1524 2036 5CB0.tmp 40 PID 2036 wrote to memory of 1524 2036 5CB0.tmp 40 PID 2036 wrote to memory of 1524 2036 5CB0.tmp 40 PID 2036 wrote to memory of 1524 2036 5CB0.tmp 40 PID 1524 wrote to memory of 436 1524 5D5C.tmp 41 PID 1524 wrote to memory of 436 1524 5D5C.tmp 41 PID 1524 wrote to memory of 436 1524 5D5C.tmp 41 PID 1524 wrote to memory of 436 1524 5D5C.tmp 41 PID 436 wrote to memory of 1484 436 5E46.tmp 42 PID 436 wrote to memory of 1484 436 5E46.tmp 42 PID 436 wrote to memory of 1484 436 5E46.tmp 42 PID 436 wrote to memory of 1484 436 5E46.tmp 42 PID 1484 wrote to memory of 2732 1484 5F11.tmp 43 PID 1484 wrote to memory of 2732 1484 5F11.tmp 43 PID 1484 wrote to memory of 2732 1484 5F11.tmp 43 PID 1484 wrote to memory of 2732 1484 5F11.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_4aa2def1f11ae6988836774b4149567e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"C:\Users\Admin\AppData\Local\Temp\6E5D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"65⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"66⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"67⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"68⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"69⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"72⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"73⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"74⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"75⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"76⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"77⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"78⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"79⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"80⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"81⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"82⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"83⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"84⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"85⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"86⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"87⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"88⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"89⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"90⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"91⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\869D.tmp"C:\Users\Admin\AppData\Local\Temp\869D.tmp"92⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\870B.tmp"C:\Users\Admin\AppData\Local\Temp\870B.tmp"93⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"94⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"97⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\895B.tmp"C:\Users\Admin\AppData\Local\Temp\895B.tmp"98⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"99⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"100⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"101⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"102⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"103⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"104⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"105⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"106⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"107⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"108⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"109⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"110⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"111⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"112⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"113⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"114⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"116⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"117⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"118⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"119⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"120⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"121⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-