Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 13:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe
-
Size
486KB
-
MD5
1ee91e138dcebe2fd95404441d95e1c0
-
SHA1
c84de2b1813a39d6dfffe2ed21c4b386be6387cf
-
SHA256
79378e323461c04737d8a774cf9115ed549f828452ce8daeb2e1d93a3bb9c80d
-
SHA512
eefbd9df22a77da74820ea19f164fc416a131ba6e58bac20088de261919abd3b7011691e23a1a0d09d2c74a04f6e95eb6a1ee9c0e1458a98be142ea1340c8828
-
SSDEEP
12288:/U5rCOTeiD/LWul+npm3BqZvTPaIEaYoNZ:/UQOJD/LHA43AZvTPaIEboN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2180 3EF4.tmp 2116 3F70.tmp 2720 406A.tmp 2800 4173.tmp 2704 421F.tmp 2692 42DA.tmp 2932 4395.tmp 2748 4441.tmp 2568 450C.tmp 2652 45C7.tmp 2624 4692.tmp 2552 475C.tmp 2860 4818.tmp 2908 48A4.tmp 2900 497E.tmp 2484 49EC.tmp 1996 4AB6.tmp 340 4B43.tmp 2508 4BDF.tmp 524 4C8A.tmp 900 4CF8.tmp 1648 4D74.tmp 1720 4E3F.tmp 2384 4EBC.tmp 1696 4F1A.tmp 1560 4F77.tmp 1872 4FE4.tmp 2328 514B.tmp 2672 5264.tmp 2320 536D.tmp 1068 53BB.tmp 2392 5419.tmp 2980 5486.tmp 2372 54E4.tmp 1860 5560.tmp 896 55ED.tmp 2324 564A.tmp 1152 56B8.tmp 828 5725.tmp 1564 57B1.tmp 940 582E.tmp 936 58AB.tmp 2340 5918.tmp 1372 5995.tmp 2976 5A02.tmp 2988 5A7F.tmp 2172 5AFC.tmp 1896 5B69.tmp 296 5BD6.tmp 2992 5C53.tmp 2956 5CC0.tmp 2260 5D3D.tmp 2056 5D9A.tmp 1740 5E08.tmp 1320 5E65.tmp 1124 5ED2.tmp 1892 5F40.tmp 2228 5FBC.tmp 2788 601A.tmp 2832 6097.tmp 2728 6114.tmp 2952 6190.tmp 2240 620D.tmp 2772 626B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1740 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 2180 3EF4.tmp 2116 3F70.tmp 2720 406A.tmp 2800 4173.tmp 2704 421F.tmp 2692 42DA.tmp 2932 4395.tmp 2748 4441.tmp 2568 450C.tmp 2652 45C7.tmp 2624 4692.tmp 2552 475C.tmp 2860 4818.tmp 2908 48A4.tmp 2900 497E.tmp 2484 49EC.tmp 1996 4AB6.tmp 340 4B43.tmp 2508 4BDF.tmp 524 4C8A.tmp 900 4CF8.tmp 1648 4D74.tmp 1720 4E3F.tmp 2384 4EBC.tmp 1696 4F1A.tmp 1560 4F77.tmp 1872 4FE4.tmp 2328 514B.tmp 2672 5264.tmp 2320 536D.tmp 1068 53BB.tmp 2392 5419.tmp 2980 5486.tmp 2372 54E4.tmp 1860 5560.tmp 896 55ED.tmp 2324 564A.tmp 1152 56B8.tmp 828 5725.tmp 1564 57B1.tmp 940 582E.tmp 936 58AB.tmp 2340 5918.tmp 1372 5995.tmp 2976 5A02.tmp 2988 5A7F.tmp 2172 5AFC.tmp 1896 5B69.tmp 296 5BD6.tmp 2992 5C53.tmp 2956 5CC0.tmp 2260 5D3D.tmp 2056 5D9A.tmp 1740 5E08.tmp 1320 5E65.tmp 1124 5ED2.tmp 1892 5F40.tmp 2228 5FBC.tmp 2788 601A.tmp 2832 6097.tmp 2728 6114.tmp 2952 6190.tmp 2240 620D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2180 1740 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 28 PID 1740 wrote to memory of 2180 1740 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 28 PID 1740 wrote to memory of 2180 1740 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 28 PID 1740 wrote to memory of 2180 1740 2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe 28 PID 2180 wrote to memory of 2116 2180 3EF4.tmp 29 PID 2180 wrote to memory of 2116 2180 3EF4.tmp 29 PID 2180 wrote to memory of 2116 2180 3EF4.tmp 29 PID 2180 wrote to memory of 2116 2180 3EF4.tmp 29 PID 2116 wrote to memory of 2720 2116 3F70.tmp 30 PID 2116 wrote to memory of 2720 2116 3F70.tmp 30 PID 2116 wrote to memory of 2720 2116 3F70.tmp 30 PID 2116 wrote to memory of 2720 2116 3F70.tmp 30 PID 2720 wrote to memory of 2800 2720 406A.tmp 31 PID 2720 wrote to memory of 2800 2720 406A.tmp 31 PID 2720 wrote to memory of 2800 2720 406A.tmp 31 PID 2720 wrote to memory of 2800 2720 406A.tmp 31 PID 2800 wrote to memory of 2704 2800 4173.tmp 32 PID 2800 wrote to memory of 2704 2800 4173.tmp 32 PID 2800 wrote to memory of 2704 2800 4173.tmp 32 PID 2800 wrote to memory of 2704 2800 4173.tmp 32 PID 2704 wrote to memory of 2692 2704 421F.tmp 33 PID 2704 wrote to memory of 2692 2704 421F.tmp 33 PID 2704 wrote to memory of 2692 2704 421F.tmp 33 PID 2704 wrote to memory of 2692 2704 421F.tmp 33 PID 2692 wrote to memory of 2932 2692 42DA.tmp 34 PID 2692 wrote to memory of 2932 2692 42DA.tmp 34 PID 2692 wrote to memory of 2932 2692 42DA.tmp 34 PID 2692 wrote to memory of 2932 2692 42DA.tmp 34 PID 2932 wrote to memory of 2748 2932 4395.tmp 35 PID 2932 wrote to memory of 2748 2932 4395.tmp 35 PID 2932 wrote to memory of 2748 2932 4395.tmp 35 PID 2932 wrote to memory of 2748 2932 4395.tmp 35 PID 2748 wrote to memory of 2568 2748 4441.tmp 36 PID 2748 wrote to memory of 2568 2748 4441.tmp 36 PID 2748 wrote to memory of 2568 2748 4441.tmp 36 PID 2748 wrote to memory of 2568 2748 4441.tmp 36 PID 2568 wrote to memory of 2652 2568 450C.tmp 37 PID 2568 wrote to memory of 2652 2568 450C.tmp 37 PID 2568 wrote to memory of 2652 2568 450C.tmp 37 PID 2568 wrote to memory of 2652 2568 450C.tmp 37 PID 2652 wrote to memory of 2624 2652 45C7.tmp 38 PID 2652 wrote to memory of 2624 2652 45C7.tmp 38 PID 2652 wrote to memory of 2624 2652 45C7.tmp 38 PID 2652 wrote to memory of 2624 2652 45C7.tmp 38 PID 2624 wrote to memory of 2552 2624 4692.tmp 39 PID 2624 wrote to memory of 2552 2624 4692.tmp 39 PID 2624 wrote to memory of 2552 2624 4692.tmp 39 PID 2624 wrote to memory of 2552 2624 4692.tmp 39 PID 2552 wrote to memory of 2860 2552 475C.tmp 41 PID 2552 wrote to memory of 2860 2552 475C.tmp 41 PID 2552 wrote to memory of 2860 2552 475C.tmp 41 PID 2552 wrote to memory of 2860 2552 475C.tmp 41 PID 2860 wrote to memory of 2908 2860 4818.tmp 40 PID 2860 wrote to memory of 2908 2860 4818.tmp 40 PID 2860 wrote to memory of 2908 2860 4818.tmp 40 PID 2860 wrote to memory of 2908 2860 4818.tmp 40 PID 2908 wrote to memory of 2900 2908 48A4.tmp 42 PID 2908 wrote to memory of 2900 2908 48A4.tmp 42 PID 2908 wrote to memory of 2900 2908 48A4.tmp 42 PID 2908 wrote to memory of 2900 2908 48A4.tmp 42 PID 2900 wrote to memory of 2484 2900 497E.tmp 43 PID 2900 wrote to memory of 2484 2900 497E.tmp 43 PID 2900 wrote to memory of 2484 2900 497E.tmp 43 PID 2900 wrote to memory of 2484 2900 497E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_1ee91e138dcebe2fd95404441d95e1c0_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524
-
-
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\54E4.tmp"C:\Users\Admin\AppData\Local\Temp\54E4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"C:\Users\Admin\AppData\Local\Temp\5FBC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"44⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"45⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"46⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"47⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"48⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"49⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"50⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"51⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"52⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"53⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"54⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"55⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"56⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"57⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"58⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"59⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"60⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"C:\Users\Admin\AppData\Local\Temp\6AC4.tmp"61⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"62⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"C:\Users\Admin\AppData\Local\Temp\6BAE.tmp"63⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"64⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\6C79.tmp"C:\Users\Admin\AppData\Local\Temp\6C79.tmp"65⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"66⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"67⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"68⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"69⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"70⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"71⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"72⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"73⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"74⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"75⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"76⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"77⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"78⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"79⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"80⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"81⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"82⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"83⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"84⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"85⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"86⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"87⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"88⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\76A6.tmp"C:\Users\Admin\AppData\Local\Temp\76A6.tmp"89⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"90⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"91⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"92⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"93⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"94⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"95⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"96⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"97⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"C:\Users\Admin\AppData\Local\Temp\7A5E.tmp"98⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"99⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"100⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"101⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"102⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"103⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"104⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"105⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"106⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"107⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"108⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"109⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"110⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"112⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"113⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"114⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"115⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"116⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"117⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"118⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"119⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"120⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"121⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"122⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-