Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe
-
Size
765KB
-
MD5
a489034e8a54d22b648618952b1ae11e
-
SHA1
30cee42031d5a0785780ba3944264d4395ca1769
-
SHA256
552da0e27c404da8ba55ee6f6b4b5d0d23f0be4347f8c031923e229e7e5158f8
-
SHA512
8333f14ea44645e8e344d4fc99666c3e1a8c55ec33a4c356ae13be10c2f95c755572811d6cfa13dd98a12427a523e59979d60d75b74b78bae4aff340df21ca13
-
SSDEEP
12288:ZU5rCOTeiDQ7V/PLYMiSjjzyG83a0K9T6B3ZF5rn5rLOa54U5w5A:ZUQOJDQ5PsK9T6B3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3004 58CA.tmp 2648 5A02.tmp 2596 5B69.tmp 2700 5C24.tmp 2732 5D2D.tmp 2936 5DE8.tmp 2552 5ED2.tmp 2480 5FAD.tmp 2920 602A.tmp 2932 6114.tmp 528 622C.tmp 712 6307.tmp 1408 6420.tmp 572 64FA.tmp 2812 65D5.tmp 1736 66CE.tmp 1056 67B8.tmp 2224 6893.tmp 628 6900.tmp 2012 69EA.tmp 856 6BAE.tmp 2712 6CF6.tmp 1004 6DC1.tmp 1604 6E3D.tmp 1304 6E9B.tmp 2304 6F08.tmp 2096 6F75.tmp 2292 6FE3.tmp 3012 705F.tmp 2120 70CD.tmp 1476 713A.tmp 2788 71A7.tmp 1492 7214.tmp 1076 72A1.tmp 2996 732D.tmp 1048 73C9.tmp 1992 7446.tmp 1912 74D2.tmp 1988 755F.tmp 1564 75CC.tmp 1640 7658.tmp 2276 76C5.tmp 1964 7723.tmp 1868 7790.tmp 2372 77FD.tmp 2036 785B.tmp 2016 78C8.tmp 864 7935.tmp 3020 79A3.tmp 1168 7A00.tmp 1460 7A4E.tmp 2168 7AAC.tmp 2184 7B09.tmp 1620 7B77.tmp 2816 7BE4.tmp 2988 7C41.tmp 2588 7CAF.tmp 2636 7D2B.tmp 2852 7D89.tmp 2596 7DF6.tmp 2972 7E73.tmp 2700 7EF0.tmp 2604 8085.tmp 2732 8131.tmp -
Loads dropped DLL 64 IoCs
pid Process 2908 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 3004 58CA.tmp 2648 5A02.tmp 2596 5B69.tmp 2700 5C24.tmp 2732 5D2D.tmp 2936 5DE8.tmp 2552 5ED2.tmp 2480 5FAD.tmp 2920 602A.tmp 2932 6114.tmp 528 622C.tmp 712 6307.tmp 1408 6420.tmp 572 64FA.tmp 2812 65D5.tmp 1736 66CE.tmp 1056 67B8.tmp 2224 6893.tmp 628 6900.tmp 2012 69EA.tmp 856 6BAE.tmp 2712 6CF6.tmp 1004 6DC1.tmp 1604 6E3D.tmp 1304 6E9B.tmp 2304 6F08.tmp 2096 6F75.tmp 2292 6FE3.tmp 3012 705F.tmp 2120 70CD.tmp 1476 713A.tmp 2788 71A7.tmp 1492 7214.tmp 1076 72A1.tmp 2996 732D.tmp 1048 73C9.tmp 1992 7446.tmp 1912 74D2.tmp 1988 755F.tmp 1564 75CC.tmp 1640 7658.tmp 2276 76C5.tmp 1964 7723.tmp 1868 7790.tmp 2372 77FD.tmp 2036 785B.tmp 2016 78C8.tmp 864 7935.tmp 3020 79A3.tmp 1168 7A00.tmp 1460 7A4E.tmp 2168 7AAC.tmp 2184 7B09.tmp 1620 7B77.tmp 2816 7BE4.tmp 2988 7C41.tmp 2588 7CAF.tmp 2636 7D2B.tmp 2852 7D89.tmp 2596 7DF6.tmp 2972 7E73.tmp 2700 7EF0.tmp 2604 8085.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3004 2908 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 28 PID 2908 wrote to memory of 3004 2908 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 28 PID 2908 wrote to memory of 3004 2908 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 28 PID 2908 wrote to memory of 3004 2908 2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe 28 PID 3004 wrote to memory of 2648 3004 58CA.tmp 29 PID 3004 wrote to memory of 2648 3004 58CA.tmp 29 PID 3004 wrote to memory of 2648 3004 58CA.tmp 29 PID 3004 wrote to memory of 2648 3004 58CA.tmp 29 PID 2648 wrote to memory of 2596 2648 5A02.tmp 30 PID 2648 wrote to memory of 2596 2648 5A02.tmp 30 PID 2648 wrote to memory of 2596 2648 5A02.tmp 30 PID 2648 wrote to memory of 2596 2648 5A02.tmp 30 PID 2596 wrote to memory of 2700 2596 5B69.tmp 31 PID 2596 wrote to memory of 2700 2596 5B69.tmp 31 PID 2596 wrote to memory of 2700 2596 5B69.tmp 31 PID 2596 wrote to memory of 2700 2596 5B69.tmp 31 PID 2700 wrote to memory of 2732 2700 5C24.tmp 32 PID 2700 wrote to memory of 2732 2700 5C24.tmp 32 PID 2700 wrote to memory of 2732 2700 5C24.tmp 32 PID 2700 wrote to memory of 2732 2700 5C24.tmp 32 PID 2732 wrote to memory of 2936 2732 5D2D.tmp 33 PID 2732 wrote to memory of 2936 2732 5D2D.tmp 33 PID 2732 wrote to memory of 2936 2732 5D2D.tmp 33 PID 2732 wrote to memory of 2936 2732 5D2D.tmp 33 PID 2936 wrote to memory of 2552 2936 5DE8.tmp 34 PID 2936 wrote to memory of 2552 2936 5DE8.tmp 34 PID 2936 wrote to memory of 2552 2936 5DE8.tmp 34 PID 2936 wrote to memory of 2552 2936 5DE8.tmp 34 PID 2552 wrote to memory of 2480 2552 5ED2.tmp 35 PID 2552 wrote to memory of 2480 2552 5ED2.tmp 35 PID 2552 wrote to memory of 2480 2552 5ED2.tmp 35 PID 2552 wrote to memory of 2480 2552 5ED2.tmp 35 PID 2480 wrote to memory of 2920 2480 5FAD.tmp 36 PID 2480 wrote to memory of 2920 2480 5FAD.tmp 36 PID 2480 wrote to memory of 2920 2480 5FAD.tmp 36 PID 2480 wrote to memory of 2920 2480 5FAD.tmp 36 PID 2920 wrote to memory of 2932 2920 602A.tmp 37 PID 2920 wrote to memory of 2932 2920 602A.tmp 37 PID 2920 wrote to memory of 2932 2920 602A.tmp 37 PID 2920 wrote to memory of 2932 2920 602A.tmp 37 PID 2932 wrote to memory of 528 2932 6114.tmp 38 PID 2932 wrote to memory of 528 2932 6114.tmp 38 PID 2932 wrote to memory of 528 2932 6114.tmp 38 PID 2932 wrote to memory of 528 2932 6114.tmp 38 PID 528 wrote to memory of 712 528 622C.tmp 39 PID 528 wrote to memory of 712 528 622C.tmp 39 PID 528 wrote to memory of 712 528 622C.tmp 39 PID 528 wrote to memory of 712 528 622C.tmp 39 PID 712 wrote to memory of 1408 712 6307.tmp 40 PID 712 wrote to memory of 1408 712 6307.tmp 40 PID 712 wrote to memory of 1408 712 6307.tmp 40 PID 712 wrote to memory of 1408 712 6307.tmp 40 PID 1408 wrote to memory of 572 1408 6420.tmp 41 PID 1408 wrote to memory of 572 1408 6420.tmp 41 PID 1408 wrote to memory of 572 1408 6420.tmp 41 PID 1408 wrote to memory of 572 1408 6420.tmp 41 PID 572 wrote to memory of 2812 572 64FA.tmp 42 PID 572 wrote to memory of 2812 572 64FA.tmp 42 PID 572 wrote to memory of 2812 572 64FA.tmp 42 PID 572 wrote to memory of 2812 572 64FA.tmp 42 PID 2812 wrote to memory of 1736 2812 65D5.tmp 43 PID 2812 wrote to memory of 1736 2812 65D5.tmp 43 PID 2812 wrote to memory of 1736 2812 65D5.tmp 43 PID 2812 wrote to memory of 1736 2812 65D5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_a489034e8a54d22b648618952b1ae11e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\622C.tmp"C:\Users\Admin\AppData\Local\Temp\622C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\72A1.tmp"C:\Users\Admin\AppData\Local\Temp\72A1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"65⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"66⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"67⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"68⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8305.tmp"C:\Users\Admin\AppData\Local\Temp\8305.tmp"69⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"70⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\83EF.tmp"C:\Users\Admin\AppData\Local\Temp\83EF.tmp"71⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"72⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"73⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"74⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"75⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"76⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"78⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"79⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\87C6.tmp"C:\Users\Admin\AppData\Local\Temp\87C6.tmp"80⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"81⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"82⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"83⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"84⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"85⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"86⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"87⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"88⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"89⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"90⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"91⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"92⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"93⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"95⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"96⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"97⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"98⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"99⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"100⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"101⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"102⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"103⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"104⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"105⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"106⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"107⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"108⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"109⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"110⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"111⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"113⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"114⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"115⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"116⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\9972.tmp"C:\Users\Admin\AppData\Local\Temp\9972.tmp"118⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"119⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"120⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"121⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"122⤵PID:2184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-