Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe
-
Size
486KB
-
MD5
641bd0dbbcd671a0f9c64cbf7c062126
-
SHA1
0f59b73a4402d99e37729431d9209b339f970723
-
SHA256
dc905c5525f62a59b43073ff764ee1c337030d24dffb5eb830126d000e94c4ec
-
SHA512
9e6c50f0ae882aac4baafa2709c6652061e1e6f99d09fc6cf95fa1e721d86f4dbc511add797f4618884874a10d024c54e6a3eb2e29aef265e1622b2f03e0566c
-
SSDEEP
12288:/U5rCOTeiDm64qrcfun+6vtAU6WXkBNZ:/UQOJDmXk62yU6MkBN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2288 3CB2.tmp 2688 3D4E.tmp 2744 3E19.tmp 2860 3EB5.tmp 2724 3F61.tmp 2760 402C.tmp 2872 40C8.tmp 2652 424E.tmp 2608 42F9.tmp 2672 4395.tmp 2856 4402.tmp 744 44DD.tmp 1800 4569.tmp 2644 45F6.tmp 2976 4692.tmp 1724 475C.tmp 1224 47CA.tmp 2252 4875.tmp 1956 48E2.tmp 796 497E.tmp 520 49FB.tmp 764 4AC6.tmp 2528 4B33.tmp 1684 4B91.tmp 1624 4BEE.tmp 560 4C4C.tmp 2388 4CAA.tmp 2500 4D07.tmp 2520 4D74.tmp 2416 4EEB.tmp 3068 4F48.tmp 2508 4FB6.tmp 2332 5023.tmp 1372 5080.tmp 2208 50DE.tmp 1448 514B.tmp 2376 51B8.tmp 1184 5226.tmp 1532 5293.tmp 1308 5310.tmp 1744 537D.tmp 1324 53EA.tmp 1400 5457.tmp 1796 54C4.tmp 896 5541.tmp 604 55AE.tmp 1520 566A.tmp 1144 56F6.tmp 1812 5754.tmp 976 580F.tmp 776 589B.tmp 2160 58F9.tmp 1688 59A4.tmp 2912 5A02.tmp 3032 5A6F.tmp 1600 5AEC.tmp 3016 5B4A.tmp 2276 5BA7.tmp 2740 5C05.tmp 2488 5C82.tmp 2744 5CEF.tmp 2920 5D5C.tmp 2704 5DBA.tmp 2732 5E08.tmp -
Loads dropped DLL 64 IoCs
pid Process 2980 2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe 2288 3CB2.tmp 2688 3D4E.tmp 2744 3E19.tmp 2860 3EB5.tmp 2724 3F61.tmp 2760 402C.tmp 2872 40C8.tmp 2652 424E.tmp 2608 42F9.tmp 2672 4395.tmp 2856 4402.tmp 744 44DD.tmp 1800 4569.tmp 2644 45F6.tmp 2976 4692.tmp 1724 475C.tmp 1224 47CA.tmp 2252 4875.tmp 1956 48E2.tmp 796 497E.tmp 520 49FB.tmp 764 4AC6.tmp 2528 4B33.tmp 1684 4B91.tmp 1624 4BEE.tmp 560 4C4C.tmp 2388 4CAA.tmp 2500 4D07.tmp 2520 4D74.tmp 2416 4EEB.tmp 3068 4F48.tmp 2508 4FB6.tmp 2332 5023.tmp 1372 5080.tmp 2208 50DE.tmp 1448 514B.tmp 2376 51B8.tmp 1184 5226.tmp 1532 5293.tmp 1308 5310.tmp 1744 537D.tmp 1324 53EA.tmp 1400 5457.tmp 1796 54C4.tmp 896 5541.tmp 604 55AE.tmp 1520 566A.tmp 1144 56F6.tmp 1812 5754.tmp 976 580F.tmp 776 589B.tmp 2160 58F9.tmp 1688 59A4.tmp 2912 5A02.tmp 3032 5A6F.tmp 1600 5AEC.tmp 3016 5B4A.tmp 2276 5BA7.tmp 2740 5C05.tmp 2488 5C82.tmp 2744 5CEF.tmp 2920 5D5C.tmp 2704 5DBA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2288 2980 2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe 28 PID 2980 wrote to memory of 2288 2980 2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe 28 PID 2980 wrote to memory of 2288 2980 2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe 28 PID 2980 wrote to memory of 2288 2980 2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe 28 PID 2288 wrote to memory of 2688 2288 3CB2.tmp 29 PID 2288 wrote to memory of 2688 2288 3CB2.tmp 29 PID 2288 wrote to memory of 2688 2288 3CB2.tmp 29 PID 2288 wrote to memory of 2688 2288 3CB2.tmp 29 PID 2688 wrote to memory of 2744 2688 3D4E.tmp 30 PID 2688 wrote to memory of 2744 2688 3D4E.tmp 30 PID 2688 wrote to memory of 2744 2688 3D4E.tmp 30 PID 2688 wrote to memory of 2744 2688 3D4E.tmp 30 PID 2744 wrote to memory of 2860 2744 3E19.tmp 31 PID 2744 wrote to memory of 2860 2744 3E19.tmp 31 PID 2744 wrote to memory of 2860 2744 3E19.tmp 31 PID 2744 wrote to memory of 2860 2744 3E19.tmp 31 PID 2860 wrote to memory of 2724 2860 3EB5.tmp 32 PID 2860 wrote to memory of 2724 2860 3EB5.tmp 32 PID 2860 wrote to memory of 2724 2860 3EB5.tmp 32 PID 2860 wrote to memory of 2724 2860 3EB5.tmp 32 PID 2724 wrote to memory of 2760 2724 3F61.tmp 33 PID 2724 wrote to memory of 2760 2724 3F61.tmp 33 PID 2724 wrote to memory of 2760 2724 3F61.tmp 33 PID 2724 wrote to memory of 2760 2724 3F61.tmp 33 PID 2760 wrote to memory of 2872 2760 402C.tmp 34 PID 2760 wrote to memory of 2872 2760 402C.tmp 34 PID 2760 wrote to memory of 2872 2760 402C.tmp 34 PID 2760 wrote to memory of 2872 2760 402C.tmp 34 PID 2872 wrote to memory of 2652 2872 40C8.tmp 35 PID 2872 wrote to memory of 2652 2872 40C8.tmp 35 PID 2872 wrote to memory of 2652 2872 40C8.tmp 35 PID 2872 wrote to memory of 2652 2872 40C8.tmp 35 PID 2652 wrote to memory of 2608 2652 424E.tmp 36 PID 2652 wrote to memory of 2608 2652 424E.tmp 36 PID 2652 wrote to memory of 2608 2652 424E.tmp 36 PID 2652 wrote to memory of 2608 2652 424E.tmp 36 PID 2608 wrote to memory of 2672 2608 42F9.tmp 37 PID 2608 wrote to memory of 2672 2608 42F9.tmp 37 PID 2608 wrote to memory of 2672 2608 42F9.tmp 37 PID 2608 wrote to memory of 2672 2608 42F9.tmp 37 PID 2672 wrote to memory of 2856 2672 4395.tmp 38 PID 2672 wrote to memory of 2856 2672 4395.tmp 38 PID 2672 wrote to memory of 2856 2672 4395.tmp 38 PID 2672 wrote to memory of 2856 2672 4395.tmp 38 PID 2856 wrote to memory of 744 2856 4402.tmp 39 PID 2856 wrote to memory of 744 2856 4402.tmp 39 PID 2856 wrote to memory of 744 2856 4402.tmp 39 PID 2856 wrote to memory of 744 2856 4402.tmp 39 PID 744 wrote to memory of 1800 744 44DD.tmp 40 PID 744 wrote to memory of 1800 744 44DD.tmp 40 PID 744 wrote to memory of 1800 744 44DD.tmp 40 PID 744 wrote to memory of 1800 744 44DD.tmp 40 PID 1800 wrote to memory of 2644 1800 4569.tmp 42 PID 1800 wrote to memory of 2644 1800 4569.tmp 42 PID 1800 wrote to memory of 2644 1800 4569.tmp 42 PID 1800 wrote to memory of 2644 1800 4569.tmp 42 PID 2644 wrote to memory of 2976 2644 45F6.tmp 41 PID 2644 wrote to memory of 2976 2644 45F6.tmp 41 PID 2644 wrote to memory of 2976 2644 45F6.tmp 41 PID 2644 wrote to memory of 2976 2644 45F6.tmp 41 PID 2976 wrote to memory of 1724 2976 4692.tmp 43 PID 2976 wrote to memory of 1724 2976 4692.tmp 43 PID 2976 wrote to memory of 1724 2976 4692.tmp 43 PID 2976 wrote to memory of 1724 2976 4692.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-24_641bd0dbbcd671a0f9c64cbf7c062126_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224
-
-
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796
-
-
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684
-
-
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\54C4.tmp"C:\Users\Admin\AppData\Local\Temp\54C4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\5541.tmp"C:\Users\Admin\AppData\Local\Temp\5541.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"40⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"41⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"42⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"43⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"44⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"45⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"46⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"47⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"48⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"49⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"50⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"51⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"52⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"53⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"54⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"55⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"56⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"57⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"58⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"59⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"60⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"61⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"62⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"63⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"64⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"65⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"66⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"67⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"68⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6D34.tmp"C:\Users\Admin\AppData\Local\Temp\6D34.tmp"69⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"70⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"C:\Users\Admin\AppData\Local\Temp\6E0F.tmp"71⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"72⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"73⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"74⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"75⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"76⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"77⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"78⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"79⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"80⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"81⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"82⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"83⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"84⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"85⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"86⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"87⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"88⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"89⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"90⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"92⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"93⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"94⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"95⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"96⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"97⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"98⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"99⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\79A3.tmp"C:\Users\Admin\AppData\Local\Temp\79A3.tmp"100⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"101⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"102⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"103⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"104⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"105⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"106⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"107⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"108⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"109⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"110⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"111⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"112⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"113⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"115⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"116⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"117⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"118⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"119⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\83EF.tmp"C:\Users\Admin\AppData\Local\Temp\83EF.tmp"120⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"121⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-