Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe
-
Size
520KB
-
MD5
822f156bee883eed5d6174164fe6ac23
-
SHA1
c8f7165effd60484d073762aa0bbd828f5b3dac0
-
SHA256
dd5bb73bed017478c811ba885f1068bd736c0d52b99564b5940e2ac90a1c1027
-
SHA512
7af3267c6869d59f99471059c7d3fed3767d9bff5679eb121b5542eb6c3cc4cf94c22a9b5599d67dba093776ac71cc290e55ab872dcab0f0b2a2ea8a51755902
-
SSDEEP
12288:roRXOQjmOyoKgJme4BBOQ7GkH/ne1fiNZ:rogQ9ylHre16N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2004 4F1A.tmp 1532 4FC5.tmp 2244 510D.tmp 2704 5216.tmp 2856 5300.tmp 2764 53EA.tmp 2576 54C4.tmp 2816 55AE.tmp 2408 56B8.tmp 2476 5773.tmp 2580 588C.tmp 1996 5947.tmp 1432 5A40.tmp 776 5AEC.tmp 2528 5BF5.tmp 2680 5CC0.tmp 2036 5DC9.tmp 2020 5E84.tmp 1100 5F8E.tmp 1092 6087.tmp 744 621D.tmp 1076 6374.tmp 892 644F.tmp 1768 64CB.tmp 2668 6558.tmp 1592 65D5.tmp 1632 6651.tmp 3048 66CE.tmp 2916 674B.tmp 2312 67F7.tmp 1164 6883.tmp 3024 6900.tmp 2204 698C.tmp 1012 69F9.tmp 1820 6A57.tmp 608 6AC4.tmp 2380 6B22.tmp 2284 6B9F.tmp 700 6C0C.tmp 1948 6C89.tmp 1492 6D15.tmp 1096 6DB1.tmp 1832 6E1E.tmp 1920 6EBA.tmp 1828 6F27.tmp 952 6FA4.tmp 2256 7002.tmp 2884 708E.tmp 1116 711B.tmp 2196 7188.tmp 1280 71E5.tmp 1752 7253.tmp 2384 72C0.tmp 2216 734C.tmp 1104 73C9.tmp 1608 7436.tmp 2144 74B3.tmp 2964 7530.tmp 3016 759D.tmp 3040 7629.tmp 2244 76B6.tmp 2748 77AF.tmp 2848 782C.tmp 2592 78A9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2780 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 2004 4F1A.tmp 1532 4FC5.tmp 2244 510D.tmp 2704 5216.tmp 2856 5300.tmp 2764 53EA.tmp 2576 54C4.tmp 2816 55AE.tmp 2408 56B8.tmp 2476 5773.tmp 2580 588C.tmp 1996 5947.tmp 1432 5A40.tmp 776 5AEC.tmp 2528 5BF5.tmp 2680 5CC0.tmp 2036 5DC9.tmp 2020 5E84.tmp 1100 5F8E.tmp 1092 6087.tmp 744 621D.tmp 1076 6374.tmp 892 644F.tmp 1768 64CB.tmp 2668 6558.tmp 1592 65D5.tmp 1632 6651.tmp 3048 66CE.tmp 2916 674B.tmp 2312 67F7.tmp 1164 6883.tmp 3024 6900.tmp 2204 698C.tmp 1012 69F9.tmp 1820 6A57.tmp 608 6AC4.tmp 2380 6B22.tmp 2284 6B9F.tmp 700 6C0C.tmp 1948 6C89.tmp 1492 6D15.tmp 1096 6DB1.tmp 1832 6E1E.tmp 1920 6EBA.tmp 1828 6F27.tmp 952 6FA4.tmp 2256 7002.tmp 2884 708E.tmp 1116 711B.tmp 2196 7188.tmp 1280 71E5.tmp 1752 7253.tmp 2384 72C0.tmp 2216 734C.tmp 1104 73C9.tmp 1608 7436.tmp 2144 74B3.tmp 2964 7530.tmp 3016 759D.tmp 3040 7629.tmp 2244 76B6.tmp 2748 77AF.tmp 2848 782C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2004 2780 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 28 PID 2780 wrote to memory of 2004 2780 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 28 PID 2780 wrote to memory of 2004 2780 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 28 PID 2780 wrote to memory of 2004 2780 2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe 28 PID 2004 wrote to memory of 1532 2004 4F1A.tmp 29 PID 2004 wrote to memory of 1532 2004 4F1A.tmp 29 PID 2004 wrote to memory of 1532 2004 4F1A.tmp 29 PID 2004 wrote to memory of 1532 2004 4F1A.tmp 29 PID 1532 wrote to memory of 2244 1532 4FC5.tmp 30 PID 1532 wrote to memory of 2244 1532 4FC5.tmp 30 PID 1532 wrote to memory of 2244 1532 4FC5.tmp 30 PID 1532 wrote to memory of 2244 1532 4FC5.tmp 30 PID 2244 wrote to memory of 2704 2244 510D.tmp 31 PID 2244 wrote to memory of 2704 2244 510D.tmp 31 PID 2244 wrote to memory of 2704 2244 510D.tmp 31 PID 2244 wrote to memory of 2704 2244 510D.tmp 31 PID 2704 wrote to memory of 2856 2704 5216.tmp 32 PID 2704 wrote to memory of 2856 2704 5216.tmp 32 PID 2704 wrote to memory of 2856 2704 5216.tmp 32 PID 2704 wrote to memory of 2856 2704 5216.tmp 32 PID 2856 wrote to memory of 2764 2856 5300.tmp 33 PID 2856 wrote to memory of 2764 2856 5300.tmp 33 PID 2856 wrote to memory of 2764 2856 5300.tmp 33 PID 2856 wrote to memory of 2764 2856 5300.tmp 33 PID 2764 wrote to memory of 2576 2764 53EA.tmp 34 PID 2764 wrote to memory of 2576 2764 53EA.tmp 34 PID 2764 wrote to memory of 2576 2764 53EA.tmp 34 PID 2764 wrote to memory of 2576 2764 53EA.tmp 34 PID 2576 wrote to memory of 2816 2576 54C4.tmp 35 PID 2576 wrote to memory of 2816 2576 54C4.tmp 35 PID 2576 wrote to memory of 2816 2576 54C4.tmp 35 PID 2576 wrote to memory of 2816 2576 54C4.tmp 35 PID 2816 wrote to memory of 2408 2816 55AE.tmp 36 PID 2816 wrote to memory of 2408 2816 55AE.tmp 36 PID 2816 wrote to memory of 2408 2816 55AE.tmp 36 PID 2816 wrote to memory of 2408 2816 55AE.tmp 36 PID 2408 wrote to memory of 2476 2408 56B8.tmp 37 PID 2408 wrote to memory of 2476 2408 56B8.tmp 37 PID 2408 wrote to memory of 2476 2408 56B8.tmp 37 PID 2408 wrote to memory of 2476 2408 56B8.tmp 37 PID 2476 wrote to memory of 2580 2476 5773.tmp 38 PID 2476 wrote to memory of 2580 2476 5773.tmp 38 PID 2476 wrote to memory of 2580 2476 5773.tmp 38 PID 2476 wrote to memory of 2580 2476 5773.tmp 38 PID 2580 wrote to memory of 1996 2580 588C.tmp 39 PID 2580 wrote to memory of 1996 2580 588C.tmp 39 PID 2580 wrote to memory of 1996 2580 588C.tmp 39 PID 2580 wrote to memory of 1996 2580 588C.tmp 39 PID 1996 wrote to memory of 1432 1996 5947.tmp 40 PID 1996 wrote to memory of 1432 1996 5947.tmp 40 PID 1996 wrote to memory of 1432 1996 5947.tmp 40 PID 1996 wrote to memory of 1432 1996 5947.tmp 40 PID 1432 wrote to memory of 776 1432 5A40.tmp 41 PID 1432 wrote to memory of 776 1432 5A40.tmp 41 PID 1432 wrote to memory of 776 1432 5A40.tmp 41 PID 1432 wrote to memory of 776 1432 5A40.tmp 41 PID 776 wrote to memory of 2528 776 5AEC.tmp 42 PID 776 wrote to memory of 2528 776 5AEC.tmp 42 PID 776 wrote to memory of 2528 776 5AEC.tmp 42 PID 776 wrote to memory of 2528 776 5AEC.tmp 42 PID 2528 wrote to memory of 2680 2528 5BF5.tmp 43 PID 2528 wrote to memory of 2680 2528 5BF5.tmp 43 PID 2528 wrote to memory of 2680 2528 5BF5.tmp 43 PID 2528 wrote to memory of 2680 2528 5BF5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_822f156bee883eed5d6174164fe6ac23_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\5E84.tmp"C:\Users\Admin\AppData\Local\Temp\5E84.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\77AF.tmp"C:\Users\Admin\AppData\Local\Temp\77AF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"65⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"66⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"67⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"68⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"69⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"70⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"71⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"72⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7C80.tmp"C:\Users\Admin\AppData\Local\Temp\7C80.tmp"73⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"75⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"76⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"77⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"78⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"79⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"80⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"81⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"82⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"83⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"84⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"85⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"86⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"87⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"88⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"89⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"90⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"91⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"92⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp"93⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"94⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"95⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"96⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"97⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"98⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"99⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"100⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\895B.tmp"C:\Users\Admin\AppData\Local\Temp\895B.tmp"101⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"102⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"103⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"104⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"105⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"106⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"107⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"108⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"109⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"111⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"112⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"113⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"114⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"115⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"116⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"117⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"118⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"119⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"120⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"121⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-