Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe
-
Size
527KB
-
MD5
f41bbfc75449e702d73d585aa4cb6927
-
SHA1
d891b58798dbd63dc722c4c852393c5220fd9992
-
SHA256
2f82d2680398508fd2a88d4c7a87a32a5bc2ff939ca0db58163eae82c9504289
-
SHA512
afec81966ad64ac8998d0819cb790b70bda0f05a4ea96f0c28bdd4f113ea6baaef730a81718b77fc763697001fa53234d0551b81b565a4abc2ed2d34a1fa22a1
-
SSDEEP
12288:fU5rCOTeidTi2YFSPz+2AvXizizof+E23nm/hDwDZu:fUQOJdxwuzb3zd2znm/hDwDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2488 49FB.tmp 1932 4A68.tmp 2248 4B81.tmp 2020 4C2D.tmp 2772 4CD8.tmp 2536 4D55.tmp 2796 4E3F.tmp 3020 4ECC.tmp 2572 4F1A.tmp 2544 5004.tmp 2192 50A0.tmp 1844 515B.tmp 1796 5206.tmp 872 5274.tmp 2704 532F.tmp 2852 53EA.tmp 1240 5496.tmp 2904 54F3.tmp 1356 55FC.tmp 2436 56B8.tmp 1020 5782.tmp 572 583E.tmp 1472 5908.tmp 1868 5966.tmp 1256 5A21.tmp 1204 5C14.tmp 2412 5D0E.tmp 2348 5D9A.tmp 2224 5E65.tmp 2296 5EE2.tmp 2016 5F5F.tmp 2948 5FFB.tmp 2044 6078.tmp 2104 60F4.tmp 556 6171.tmp 896 61CF.tmp 2360 624C.tmp 736 62B9.tmp 1880 6326.tmp 1372 6393.tmp 1876 6410.tmp 936 647D.tmp 916 64FA.tmp 2392 6577.tmp 744 65E4.tmp 592 6642.tmp 2216 66BF.tmp 2032 672C.tmp 2024 6799.tmp 1992 6835.tmp 868 68C1.tmp 972 692F.tmp 2172 699C.tmp 1664 6A09.tmp 1672 6AE3.tmp 2200 6B31.tmp 2064 6BBE.tmp 1932 6C1B.tmp 2372 6C98.tmp 2768 6D05.tmp 2020 6D73.tmp 1712 6DE0.tmp 2808 6E6C.tmp 2536 6EE9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2008 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 2488 49FB.tmp 1932 4A68.tmp 2248 4B81.tmp 2020 4C2D.tmp 2772 4CD8.tmp 2536 4D55.tmp 2796 4E3F.tmp 3020 4ECC.tmp 2572 4F1A.tmp 2544 5004.tmp 2192 50A0.tmp 1844 515B.tmp 1796 5206.tmp 872 5274.tmp 2704 532F.tmp 2852 53EA.tmp 1240 5496.tmp 2904 54F3.tmp 1356 55FC.tmp 2436 56B8.tmp 1020 5782.tmp 572 583E.tmp 1472 5908.tmp 1868 5966.tmp 1256 5A21.tmp 1204 5C14.tmp 2412 5D0E.tmp 2348 5D9A.tmp 2224 5E65.tmp 2296 5EE2.tmp 2016 5F5F.tmp 2948 5FFB.tmp 2044 6078.tmp 2104 60F4.tmp 556 6171.tmp 896 61CF.tmp 2360 624C.tmp 736 62B9.tmp 1880 6326.tmp 1372 6393.tmp 1876 6410.tmp 936 647D.tmp 916 64FA.tmp 2392 6577.tmp 744 65E4.tmp 592 6642.tmp 2216 66BF.tmp 2032 672C.tmp 2024 6799.tmp 1992 6835.tmp 868 68C1.tmp 972 692F.tmp 2172 699C.tmp 2008 6A76.tmp 1672 6AE3.tmp 2200 6B31.tmp 2064 6BBE.tmp 1932 6C1B.tmp 2372 6C98.tmp 2768 6D05.tmp 2020 6D73.tmp 1712 6DE0.tmp 2808 6E6C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2488 2008 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 28 PID 2008 wrote to memory of 2488 2008 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 28 PID 2008 wrote to memory of 2488 2008 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 28 PID 2008 wrote to memory of 2488 2008 2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe 28 PID 2488 wrote to memory of 1932 2488 49FB.tmp 29 PID 2488 wrote to memory of 1932 2488 49FB.tmp 29 PID 2488 wrote to memory of 1932 2488 49FB.tmp 29 PID 2488 wrote to memory of 1932 2488 49FB.tmp 29 PID 1932 wrote to memory of 2248 1932 4A68.tmp 30 PID 1932 wrote to memory of 2248 1932 4A68.tmp 30 PID 1932 wrote to memory of 2248 1932 4A68.tmp 30 PID 1932 wrote to memory of 2248 1932 4A68.tmp 30 PID 2248 wrote to memory of 2020 2248 4B81.tmp 31 PID 2248 wrote to memory of 2020 2248 4B81.tmp 31 PID 2248 wrote to memory of 2020 2248 4B81.tmp 31 PID 2248 wrote to memory of 2020 2248 4B81.tmp 31 PID 2020 wrote to memory of 2772 2020 4C2D.tmp 32 PID 2020 wrote to memory of 2772 2020 4C2D.tmp 32 PID 2020 wrote to memory of 2772 2020 4C2D.tmp 32 PID 2020 wrote to memory of 2772 2020 4C2D.tmp 32 PID 2772 wrote to memory of 2536 2772 4CD8.tmp 33 PID 2772 wrote to memory of 2536 2772 4CD8.tmp 33 PID 2772 wrote to memory of 2536 2772 4CD8.tmp 33 PID 2772 wrote to memory of 2536 2772 4CD8.tmp 33 PID 2536 wrote to memory of 2796 2536 4D55.tmp 34 PID 2536 wrote to memory of 2796 2536 4D55.tmp 34 PID 2536 wrote to memory of 2796 2536 4D55.tmp 34 PID 2536 wrote to memory of 2796 2536 4D55.tmp 34 PID 2796 wrote to memory of 3020 2796 4E3F.tmp 35 PID 2796 wrote to memory of 3020 2796 4E3F.tmp 35 PID 2796 wrote to memory of 3020 2796 4E3F.tmp 35 PID 2796 wrote to memory of 3020 2796 4E3F.tmp 35 PID 3020 wrote to memory of 2572 3020 4ECC.tmp 36 PID 3020 wrote to memory of 2572 3020 4ECC.tmp 36 PID 3020 wrote to memory of 2572 3020 4ECC.tmp 36 PID 3020 wrote to memory of 2572 3020 4ECC.tmp 36 PID 2572 wrote to memory of 2544 2572 4F1A.tmp 37 PID 2572 wrote to memory of 2544 2572 4F1A.tmp 37 PID 2572 wrote to memory of 2544 2572 4F1A.tmp 37 PID 2572 wrote to memory of 2544 2572 4F1A.tmp 37 PID 2544 wrote to memory of 2192 2544 5004.tmp 38 PID 2544 wrote to memory of 2192 2544 5004.tmp 38 PID 2544 wrote to memory of 2192 2544 5004.tmp 38 PID 2544 wrote to memory of 2192 2544 5004.tmp 38 PID 2192 wrote to memory of 1844 2192 50A0.tmp 39 PID 2192 wrote to memory of 1844 2192 50A0.tmp 39 PID 2192 wrote to memory of 1844 2192 50A0.tmp 39 PID 2192 wrote to memory of 1844 2192 50A0.tmp 39 PID 1844 wrote to memory of 1796 1844 515B.tmp 41 PID 1844 wrote to memory of 1796 1844 515B.tmp 41 PID 1844 wrote to memory of 1796 1844 515B.tmp 41 PID 1844 wrote to memory of 1796 1844 515B.tmp 41 PID 1796 wrote to memory of 872 1796 5206.tmp 40 PID 1796 wrote to memory of 872 1796 5206.tmp 40 PID 1796 wrote to memory of 872 1796 5206.tmp 40 PID 1796 wrote to memory of 872 1796 5206.tmp 40 PID 872 wrote to memory of 2704 872 5274.tmp 42 PID 872 wrote to memory of 2704 872 5274.tmp 42 PID 872 wrote to memory of 2704 872 5274.tmp 42 PID 872 wrote to memory of 2704 872 5274.tmp 42 PID 2704 wrote to memory of 2852 2704 532F.tmp 43 PID 2704 wrote to memory of 2852 2704 532F.tmp 43 PID 2704 wrote to memory of 2852 2704 532F.tmp 43 PID 2704 wrote to memory of 2852 2704 532F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_f41bbfc75449e702d73d585aa4cb6927_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5C14.tmp"C:\Users\Admin\AppData\Local\Temp\5C14.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\692F.tmp"C:\Users\Admin\AppData\Local\Temp\692F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"41⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\6A76.tmp"C:\Users\Admin\AppData\Local\Temp\6A76.tmp"42⤵
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"C:\Users\Admin\AppData\Local\Temp\6C1B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"52⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"53⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"54⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"55⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"56⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"57⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"58⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"59⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"60⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"61⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"62⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"63⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"64⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"65⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"66⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"67⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"68⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\77CF.tmp"C:\Users\Admin\AppData\Local\Temp\77CF.tmp"69⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"70⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"71⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"72⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\7964.tmp"C:\Users\Admin\AppData\Local\Temp\7964.tmp"73⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"74⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"75⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"76⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"77⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"78⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"79⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"80⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"81⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"82⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"83⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"84⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"85⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"86⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"87⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"88⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"89⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"90⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"91⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"92⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"93⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"94⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"95⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"96⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"97⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"98⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"99⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"100⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"101⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"103⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"104⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"105⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"106⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"107⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"108⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"109⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"110⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"111⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"112⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"113⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"114⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"115⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"116⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\8D90.tmp"C:\Users\Admin\AppData\Local\Temp\8D90.tmp"117⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"118⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"119⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"120⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"121⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-