Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe
-
Size
486KB
-
MD5
a50b45ffdc2f0d6857721e86252c0476
-
SHA1
d07ec961a8d44332e2eb3f55652ae6e7fb6702bb
-
SHA256
accc63f55b064e9e24cba8b187163aa6f8cbb62b0a93c6b9b6ae2eafa369262a
-
SHA512
b0b531bc81c2567495271b58974813aa2e132884e40662d6307d00e59c6d59000ef8ec4d490da3137dea1987a4b393c03a3324d12f7dd330e48482be8f5e9113
-
SSDEEP
12288:/U5rCOTeiDIUZhINnFaNBqlQO0LWINGJNZ:/UQOJDRZoGBuZybuN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3040 390A.tmp 2472 3968.tmp 2808 3A62.tmp 2748 3B1D.tmp 2788 3BE8.tmp 2712 3CA3.tmp 2768 3D9C.tmp 2708 3E58.tmp 2628 3F13.tmp 2140 3FAF.tmp 1832 407A.tmp 2956 4154.tmp 3008 4200.tmp 2156 42EA.tmp 2892 4395.tmp 1252 4470.tmp 2696 454A.tmp 1920 45F6.tmp 2876 46C0.tmp 2908 476C.tmp 600 4818.tmp 884 48F2.tmp 1688 497E.tmp 328 49FB.tmp 2356 4A68.tmp 1132 4B81.tmp 2016 4C2D.tmp 1508 4CB9.tmp 1668 4D17.tmp 2224 4D94.tmp 2428 4E01.tmp 2376 4E6E.tmp 1112 4EEB.tmp 1516 4F58.tmp 1924 4FC5.tmp 2464 5032.tmp 2336 5080.tmp 2492 50DE.tmp 1704 516A.tmp 1352 51E7.tmp 1552 5264.tmp 952 52C2.tmp 2324 533E.tmp 1948 53BB.tmp 2904 5428.tmp 912 5486.tmp 2316 54F3.tmp 2064 558F.tmp 2460 55DD.tmp 2528 563B.tmp 2680 56A8.tmp 2516 5725.tmp 1492 5792.tmp 2020 57FF.tmp 1604 585D.tmp 1576 58DA.tmp 2776 5947.tmp 2700 59A4.tmp 2472 5A12.tmp 3064 5A8E.tmp 2704 5AFC.tmp 2836 5B4A.tmp 2868 5BA7.tmp 2816 5C24.tmp -
Loads dropped DLL 64 IoCs
pid Process 2276 2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe 3040 390A.tmp 2472 3968.tmp 2808 3A62.tmp 2748 3B1D.tmp 2788 3BE8.tmp 2712 3CA3.tmp 2768 3D9C.tmp 2708 3E58.tmp 2628 3F13.tmp 2140 3FAF.tmp 1832 407A.tmp 2956 4154.tmp 3008 4200.tmp 2156 42EA.tmp 2892 4395.tmp 1252 4470.tmp 2696 454A.tmp 1920 45F6.tmp 2876 46C0.tmp 2908 476C.tmp 600 4818.tmp 884 48F2.tmp 1688 497E.tmp 328 49FB.tmp 2356 4A68.tmp 1132 4B81.tmp 2016 4C2D.tmp 1508 4CB9.tmp 1668 4D17.tmp 2224 4D94.tmp 2428 4E01.tmp 2376 4E6E.tmp 1112 4EEB.tmp 1516 4F58.tmp 1924 4FC5.tmp 2464 5032.tmp 2336 5080.tmp 2492 50DE.tmp 1704 516A.tmp 1352 51E7.tmp 1552 5264.tmp 952 52C2.tmp 2324 533E.tmp 1948 53BB.tmp 2904 5428.tmp 912 5486.tmp 2316 54F3.tmp 2064 558F.tmp 2460 55DD.tmp 2528 563B.tmp 2680 56A8.tmp 2516 5725.tmp 1492 5792.tmp 2020 57FF.tmp 1604 585D.tmp 1576 58DA.tmp 2776 5947.tmp 2700 59A4.tmp 2472 5A12.tmp 3064 5A8E.tmp 2704 5AFC.tmp 2836 5B4A.tmp 2868 5BA7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 3040 2276 2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe 28 PID 2276 wrote to memory of 3040 2276 2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe 28 PID 2276 wrote to memory of 3040 2276 2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe 28 PID 2276 wrote to memory of 3040 2276 2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe 28 PID 3040 wrote to memory of 2472 3040 390A.tmp 29 PID 3040 wrote to memory of 2472 3040 390A.tmp 29 PID 3040 wrote to memory of 2472 3040 390A.tmp 29 PID 3040 wrote to memory of 2472 3040 390A.tmp 29 PID 2472 wrote to memory of 2808 2472 3968.tmp 30 PID 2472 wrote to memory of 2808 2472 3968.tmp 30 PID 2472 wrote to memory of 2808 2472 3968.tmp 30 PID 2472 wrote to memory of 2808 2472 3968.tmp 30 PID 2808 wrote to memory of 2748 2808 3A62.tmp 31 PID 2808 wrote to memory of 2748 2808 3A62.tmp 31 PID 2808 wrote to memory of 2748 2808 3A62.tmp 31 PID 2808 wrote to memory of 2748 2808 3A62.tmp 31 PID 2748 wrote to memory of 2788 2748 3B1D.tmp 32 PID 2748 wrote to memory of 2788 2748 3B1D.tmp 32 PID 2748 wrote to memory of 2788 2748 3B1D.tmp 32 PID 2748 wrote to memory of 2788 2748 3B1D.tmp 32 PID 2788 wrote to memory of 2712 2788 3BE8.tmp 33 PID 2788 wrote to memory of 2712 2788 3BE8.tmp 33 PID 2788 wrote to memory of 2712 2788 3BE8.tmp 33 PID 2788 wrote to memory of 2712 2788 3BE8.tmp 33 PID 2712 wrote to memory of 2768 2712 3CA3.tmp 34 PID 2712 wrote to memory of 2768 2712 3CA3.tmp 34 PID 2712 wrote to memory of 2768 2712 3CA3.tmp 34 PID 2712 wrote to memory of 2768 2712 3CA3.tmp 34 PID 2768 wrote to memory of 2708 2768 3D9C.tmp 35 PID 2768 wrote to memory of 2708 2768 3D9C.tmp 35 PID 2768 wrote to memory of 2708 2768 3D9C.tmp 35 PID 2768 wrote to memory of 2708 2768 3D9C.tmp 35 PID 2708 wrote to memory of 2628 2708 3E58.tmp 36 PID 2708 wrote to memory of 2628 2708 3E58.tmp 36 PID 2708 wrote to memory of 2628 2708 3E58.tmp 36 PID 2708 wrote to memory of 2628 2708 3E58.tmp 36 PID 2628 wrote to memory of 2140 2628 3F13.tmp 37 PID 2628 wrote to memory of 2140 2628 3F13.tmp 37 PID 2628 wrote to memory of 2140 2628 3F13.tmp 37 PID 2628 wrote to memory of 2140 2628 3F13.tmp 37 PID 2140 wrote to memory of 1832 2140 3FAF.tmp 38 PID 2140 wrote to memory of 1832 2140 3FAF.tmp 38 PID 2140 wrote to memory of 1832 2140 3FAF.tmp 38 PID 2140 wrote to memory of 1832 2140 3FAF.tmp 38 PID 1832 wrote to memory of 2956 1832 407A.tmp 39 PID 1832 wrote to memory of 2956 1832 407A.tmp 39 PID 1832 wrote to memory of 2956 1832 407A.tmp 39 PID 1832 wrote to memory of 2956 1832 407A.tmp 39 PID 2956 wrote to memory of 3008 2956 4154.tmp 40 PID 2956 wrote to memory of 3008 2956 4154.tmp 40 PID 2956 wrote to memory of 3008 2956 4154.tmp 40 PID 2956 wrote to memory of 3008 2956 4154.tmp 40 PID 3008 wrote to memory of 2156 3008 4200.tmp 41 PID 3008 wrote to memory of 2156 3008 4200.tmp 41 PID 3008 wrote to memory of 2156 3008 4200.tmp 41 PID 3008 wrote to memory of 2156 3008 4200.tmp 41 PID 2156 wrote to memory of 2892 2156 42EA.tmp 42 PID 2156 wrote to memory of 2892 2156 42EA.tmp 42 PID 2156 wrote to memory of 2892 2156 42EA.tmp 42 PID 2156 wrote to memory of 2892 2156 42EA.tmp 42 PID 2892 wrote to memory of 1252 2892 4395.tmp 43 PID 2892 wrote to memory of 1252 2892 4395.tmp 43 PID 2892 wrote to memory of 1252 2892 4395.tmp 43 PID 2892 wrote to memory of 1252 2892 4395.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_a50b45ffdc2f0d6857721e86252c0476_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\48F2.tmp"C:\Users\Admin\AppData\Local\Temp\48F2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\5032.tmp"C:\Users\Admin\AppData\Local\Temp\5032.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\55DD.tmp"C:\Users\Admin\AppData\Local\Temp\55DD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\563B.tmp"C:\Users\Admin\AppData\Local\Temp\563B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"65⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"66⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"C:\Users\Admin\AppData\Local\Temp\5CFE.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"68⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"69⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"70⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"71⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"72⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"73⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"74⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"75⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"76⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"77⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"78⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"79⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"80⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"81⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"82⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"83⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"84⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"85⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"86⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"87⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"88⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"89⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"90⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"93⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"94⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"95⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"96⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"97⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"98⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"99⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"100⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"101⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"102⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"103⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"104⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"105⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"106⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"107⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"108⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"109⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"110⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"112⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"113⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"114⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"115⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"116⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"117⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"118⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\7475.tmp"C:\Users\Admin\AppData\Local\Temp\7475.tmp"119⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"120⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"121⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-