Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 01:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe
-
Size
541KB
-
MD5
11a5b8d0f4117d0c79cd40b966c7b232
-
SHA1
f559bc17f135f4143064f1eea0a20383aa42127e
-
SHA256
cd2d28b0caca916c98472fc2a662a3c5dd4e40e9ef59027cdc286795242521b7
-
SHA512
1623069f93f141823d58ed3324e09abdee29e2682d96b3f84074694bed8e53997a355fcb03662081eaf052738f4755602f7b86e5ffcf916c252e85408278c63d
-
SSDEEP
12288:UU5rCOTeifr5vofVupT2hdRGmK706orZa73ctO:UUQOJflIVuh27RZT6orU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2856 2E9F.tmp 2388 2FA8.tmp 2732 30F0.tmp 2844 31DA.tmp 2716 32D3.tmp 2700 33AE.tmp 2972 34D6.tmp 2756 35DF.tmp 2576 36C9.tmp 2656 37A4.tmp 2304 389D.tmp 2032 3968.tmp 2684 3A62.tmp 2968 3B3C.tmp 1076 3C36.tmp 2384 3D00.tmp 328 3E29.tmp 2644 3F03.tmp 1964 401C.tmp 2876 4154.tmp 1796 42AB.tmp 1404 4376.tmp 584 4431.tmp 1768 44AE.tmp 2072 450C.tmp 2052 4579.tmp 1144 45F6.tmp 2204 4672.tmp 3020 46E0.tmp 2400 475C.tmp 860 47E9.tmp 1116 4875.tmp 1660 4902.tmp 564 497E.tmp 1228 49FB.tmp 1924 4A78.tmp 2508 4AE5.tmp 776 4B62.tmp 2540 4BDF.tmp 1356 4C6B.tmp 1084 4CE8.tmp 1348 4D65.tmp 1316 4DD2.tmp 2992 4E5E.tmp 1012 4EDB.tmp 688 4F48.tmp 1336 4FC5.tmp 1276 5032.tmp 2468 50AF.tmp 1196 510D.tmp 896 5199.tmp 1704 5235.tmp 2512 52B2.tmp 1612 533E.tmp 2772 53BB.tmp 2156 5419.tmp 1160 5496.tmp 2724 54F3.tmp 2788 5570.tmp 3008 5698.tmp 2692 5754.tmp 2588 57E0.tmp 2616 584D.tmp 2824 58CA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2500 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 2856 2E9F.tmp 2388 2FA8.tmp 2732 30F0.tmp 2844 31DA.tmp 2716 32D3.tmp 2700 33AE.tmp 2972 34D6.tmp 2756 35DF.tmp 2576 36C9.tmp 2656 37A4.tmp 2304 389D.tmp 2032 3968.tmp 2684 3A62.tmp 2968 3B3C.tmp 1076 3C36.tmp 2384 3D00.tmp 328 3E29.tmp 2644 3F03.tmp 1964 401C.tmp 2876 4154.tmp 1796 42AB.tmp 1404 4376.tmp 584 4431.tmp 1768 44AE.tmp 2072 450C.tmp 2052 4579.tmp 1144 45F6.tmp 2204 4672.tmp 3020 46E0.tmp 2400 475C.tmp 860 47E9.tmp 1116 4875.tmp 1660 4902.tmp 564 497E.tmp 1228 49FB.tmp 1924 4A78.tmp 2508 4AE5.tmp 776 4B62.tmp 2540 4BDF.tmp 1356 4C6B.tmp 1084 4CE8.tmp 1348 4D65.tmp 1316 4DD2.tmp 2992 4E5E.tmp 1012 4EDB.tmp 688 4F48.tmp 1336 4FC5.tmp 1276 5032.tmp 2468 50AF.tmp 1196 510D.tmp 896 5199.tmp 1704 5235.tmp 2512 52B2.tmp 1612 533E.tmp 2772 53BB.tmp 2156 5419.tmp 1160 5496.tmp 2724 54F3.tmp 2788 5570.tmp 3008 5698.tmp 2692 5754.tmp 2588 57E0.tmp 2616 584D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2856 2500 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 28 PID 2500 wrote to memory of 2856 2500 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 28 PID 2500 wrote to memory of 2856 2500 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 28 PID 2500 wrote to memory of 2856 2500 2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe 28 PID 2856 wrote to memory of 2388 2856 2E9F.tmp 29 PID 2856 wrote to memory of 2388 2856 2E9F.tmp 29 PID 2856 wrote to memory of 2388 2856 2E9F.tmp 29 PID 2856 wrote to memory of 2388 2856 2E9F.tmp 29 PID 2388 wrote to memory of 2732 2388 2FA8.tmp 30 PID 2388 wrote to memory of 2732 2388 2FA8.tmp 30 PID 2388 wrote to memory of 2732 2388 2FA8.tmp 30 PID 2388 wrote to memory of 2732 2388 2FA8.tmp 30 PID 2732 wrote to memory of 2844 2732 30F0.tmp 31 PID 2732 wrote to memory of 2844 2732 30F0.tmp 31 PID 2732 wrote to memory of 2844 2732 30F0.tmp 31 PID 2732 wrote to memory of 2844 2732 30F0.tmp 31 PID 2844 wrote to memory of 2716 2844 31DA.tmp 32 PID 2844 wrote to memory of 2716 2844 31DA.tmp 32 PID 2844 wrote to memory of 2716 2844 31DA.tmp 32 PID 2844 wrote to memory of 2716 2844 31DA.tmp 32 PID 2716 wrote to memory of 2700 2716 32D3.tmp 33 PID 2716 wrote to memory of 2700 2716 32D3.tmp 33 PID 2716 wrote to memory of 2700 2716 32D3.tmp 33 PID 2716 wrote to memory of 2700 2716 32D3.tmp 33 PID 2700 wrote to memory of 2972 2700 33AE.tmp 34 PID 2700 wrote to memory of 2972 2700 33AE.tmp 34 PID 2700 wrote to memory of 2972 2700 33AE.tmp 34 PID 2700 wrote to memory of 2972 2700 33AE.tmp 34 PID 2972 wrote to memory of 2756 2972 34D6.tmp 35 PID 2972 wrote to memory of 2756 2972 34D6.tmp 35 PID 2972 wrote to memory of 2756 2972 34D6.tmp 35 PID 2972 wrote to memory of 2756 2972 34D6.tmp 35 PID 2756 wrote to memory of 2576 2756 35DF.tmp 36 PID 2756 wrote to memory of 2576 2756 35DF.tmp 36 PID 2756 wrote to memory of 2576 2756 35DF.tmp 36 PID 2756 wrote to memory of 2576 2756 35DF.tmp 36 PID 2576 wrote to memory of 2656 2576 36C9.tmp 37 PID 2576 wrote to memory of 2656 2576 36C9.tmp 37 PID 2576 wrote to memory of 2656 2576 36C9.tmp 37 PID 2576 wrote to memory of 2656 2576 36C9.tmp 37 PID 2656 wrote to memory of 2304 2656 37A4.tmp 38 PID 2656 wrote to memory of 2304 2656 37A4.tmp 38 PID 2656 wrote to memory of 2304 2656 37A4.tmp 38 PID 2656 wrote to memory of 2304 2656 37A4.tmp 38 PID 2304 wrote to memory of 2032 2304 389D.tmp 39 PID 2304 wrote to memory of 2032 2304 389D.tmp 39 PID 2304 wrote to memory of 2032 2304 389D.tmp 39 PID 2304 wrote to memory of 2032 2304 389D.tmp 39 PID 2032 wrote to memory of 2684 2032 3968.tmp 40 PID 2032 wrote to memory of 2684 2032 3968.tmp 40 PID 2032 wrote to memory of 2684 2032 3968.tmp 40 PID 2032 wrote to memory of 2684 2032 3968.tmp 40 PID 2684 wrote to memory of 2968 2684 3A62.tmp 41 PID 2684 wrote to memory of 2968 2684 3A62.tmp 41 PID 2684 wrote to memory of 2968 2684 3A62.tmp 41 PID 2684 wrote to memory of 2968 2684 3A62.tmp 41 PID 2968 wrote to memory of 1076 2968 3B3C.tmp 42 PID 2968 wrote to memory of 1076 2968 3B3C.tmp 42 PID 2968 wrote to memory of 1076 2968 3B3C.tmp 42 PID 2968 wrote to memory of 1076 2968 3B3C.tmp 42 PID 1076 wrote to memory of 2384 1076 3C36.tmp 43 PID 1076 wrote to memory of 2384 1076 3C36.tmp 43 PID 1076 wrote to memory of 2384 1076 3C36.tmp 43 PID 1076 wrote to memory of 2384 1076 3C36.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_11a5b8d0f4117d0c79cd40b966c7b232_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5032.tmp"C:\Users\Admin\AppData\Local\Temp\5032.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5199.tmp"C:\Users\Admin\AppData\Local\Temp\5199.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\57E0.tmp"C:\Users\Admin\AppData\Local\Temp\57E0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"66⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"67⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"68⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"69⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"70⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"71⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"72⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"C:\Users\Admin\AppData\Local\Temp\5D2D.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"75⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"76⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"77⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"78⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"79⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"80⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"81⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"82⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"83⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"84⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"85⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"86⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"87⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"88⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\63B3.tmp"C:\Users\Admin\AppData\Local\Temp\63B3.tmp"89⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"90⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"91⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"92⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"93⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"94⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"95⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"96⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"97⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"98⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"99⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"100⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\690F.tmp"C:\Users\Admin\AppData\Local\Temp\690F.tmp"101⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"102⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"103⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"104⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"105⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"106⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"107⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"108⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"109⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"110⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"111⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"112⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"113⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"114⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"115⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"116⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"117⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"118⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"119⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"120⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"121⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-