Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 06:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe
-
Size
486KB
-
MD5
7b63c16fd32ece70b1322d85c46e1449
-
SHA1
e70c6bde6d6811fec26119b616f61c7086bf7337
-
SHA256
18463e655aaf633d3fc05e4cc51e7ba7923cafdf7c64f5c15e8990f49d6a2acc
-
SHA512
af6d83929bb10f30541c0947f0e8e28ac1b967cdd6fea972b03e803ecab9a10a6e98e3621caedafcf973e7522eada949a2707f80f6873a3b91edfc1e0db4724a
-
SSDEEP
12288:/U5rCOTeiDDAlvOhn6oNfNSG+7/3FUiPNZ:/UQOJDbJ67/1UiPN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2924 10D2.tmp 2384 1130.tmp 3052 119D.tmp 1728 120A.tmp 2596 1278.tmp 2680 12E5.tmp 2580 1342.tmp 2744 1390.tmp 2808 13DE.tmp 1776 142C.tmp 2468 146B.tmp 2624 14C8.tmp 3012 1516.tmp 2964 1584.tmp 2684 15E1.tmp 1088 162F.tmp 1532 167D.tmp 1804 16BC.tmp 1648 1719.tmp 2688 1786.tmp 944 17C5.tmp 2828 1803.tmp 1216 1842.tmp 1736 1890.tmp 2812 18DE.tmp 2304 191C.tmp 2408 195A.tmp 1988 1999.tmp 2252 19D7.tmp 540 1A16.tmp 564 1A54.tmp 608 1A92.tmp 1636 1AD1.tmp 588 1B0F.tmp 2552 1B4E.tmp 2424 1B8C.tmp 960 1BCA.tmp 452 1C09.tmp 2108 1C47.tmp 2884 1C86.tmp 2148 1CC4.tmp 1756 1D12.tmp 2000 1D60.tmp 780 1D9E.tmp 1116 1E0C.tmp 272 1E79.tmp 2404 1EC7.tmp 2180 1F05.tmp 580 1F44.tmp 1588 1F82.tmp 716 1FC0.tmp 2188 1FFF.tmp 1828 203D.tmp 1676 207C.tmp 2908 20BA.tmp 1604 20F8.tmp 2932 2137.tmp 2924 2175.tmp 2168 21B4.tmp 1064 21F2.tmp 2152 2230.tmp 2648 226F.tmp 2584 22AD.tmp 2704 22EC.tmp -
Loads dropped DLL 64 IoCs
pid Process 3004 2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe 2924 10D2.tmp 2384 1130.tmp 3052 119D.tmp 1728 120A.tmp 2596 1278.tmp 2680 12E5.tmp 2580 1342.tmp 2744 1390.tmp 2808 13DE.tmp 1776 142C.tmp 2468 146B.tmp 2624 14C8.tmp 3012 1516.tmp 2964 1584.tmp 2684 15E1.tmp 1088 162F.tmp 1532 167D.tmp 1804 16BC.tmp 1648 1719.tmp 2688 1786.tmp 944 17C5.tmp 2828 1803.tmp 1216 1842.tmp 1736 1890.tmp 2812 18DE.tmp 2304 191C.tmp 2408 195A.tmp 1988 1999.tmp 2252 19D7.tmp 540 1A16.tmp 564 1A54.tmp 608 1A92.tmp 1636 1AD1.tmp 588 1B0F.tmp 2552 1B4E.tmp 2424 1B8C.tmp 960 1BCA.tmp 452 1C09.tmp 2108 1C47.tmp 2884 1C86.tmp 2148 1CC4.tmp 1756 1D12.tmp 2000 1D60.tmp 780 1D9E.tmp 1116 1E0C.tmp 272 1E79.tmp 2404 1EC7.tmp 2180 1F05.tmp 580 1F44.tmp 1588 1F82.tmp 716 1FC0.tmp 2188 1FFF.tmp 1828 203D.tmp 1676 207C.tmp 2908 20BA.tmp 1604 20F8.tmp 2932 2137.tmp 2924 2175.tmp 2168 21B4.tmp 1064 21F2.tmp 2152 2230.tmp 2648 226F.tmp 2584 22AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2924 3004 2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe 28 PID 3004 wrote to memory of 2924 3004 2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe 28 PID 3004 wrote to memory of 2924 3004 2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe 28 PID 3004 wrote to memory of 2924 3004 2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe 28 PID 2924 wrote to memory of 2384 2924 10D2.tmp 29 PID 2924 wrote to memory of 2384 2924 10D2.tmp 29 PID 2924 wrote to memory of 2384 2924 10D2.tmp 29 PID 2924 wrote to memory of 2384 2924 10D2.tmp 29 PID 2384 wrote to memory of 3052 2384 1130.tmp 30 PID 2384 wrote to memory of 3052 2384 1130.tmp 30 PID 2384 wrote to memory of 3052 2384 1130.tmp 30 PID 2384 wrote to memory of 3052 2384 1130.tmp 30 PID 3052 wrote to memory of 1728 3052 119D.tmp 31 PID 3052 wrote to memory of 1728 3052 119D.tmp 31 PID 3052 wrote to memory of 1728 3052 119D.tmp 31 PID 3052 wrote to memory of 1728 3052 119D.tmp 31 PID 1728 wrote to memory of 2596 1728 120A.tmp 32 PID 1728 wrote to memory of 2596 1728 120A.tmp 32 PID 1728 wrote to memory of 2596 1728 120A.tmp 32 PID 1728 wrote to memory of 2596 1728 120A.tmp 32 PID 2596 wrote to memory of 2680 2596 1278.tmp 33 PID 2596 wrote to memory of 2680 2596 1278.tmp 33 PID 2596 wrote to memory of 2680 2596 1278.tmp 33 PID 2596 wrote to memory of 2680 2596 1278.tmp 33 PID 2680 wrote to memory of 2580 2680 12E5.tmp 34 PID 2680 wrote to memory of 2580 2680 12E5.tmp 34 PID 2680 wrote to memory of 2580 2680 12E5.tmp 34 PID 2680 wrote to memory of 2580 2680 12E5.tmp 34 PID 2580 wrote to memory of 2744 2580 1342.tmp 35 PID 2580 wrote to memory of 2744 2580 1342.tmp 35 PID 2580 wrote to memory of 2744 2580 1342.tmp 35 PID 2580 wrote to memory of 2744 2580 1342.tmp 35 PID 2744 wrote to memory of 2808 2744 1390.tmp 36 PID 2744 wrote to memory of 2808 2744 1390.tmp 36 PID 2744 wrote to memory of 2808 2744 1390.tmp 36 PID 2744 wrote to memory of 2808 2744 1390.tmp 36 PID 2808 wrote to memory of 1776 2808 13DE.tmp 37 PID 2808 wrote to memory of 1776 2808 13DE.tmp 37 PID 2808 wrote to memory of 1776 2808 13DE.tmp 37 PID 2808 wrote to memory of 1776 2808 13DE.tmp 37 PID 1776 wrote to memory of 2468 1776 142C.tmp 38 PID 1776 wrote to memory of 2468 1776 142C.tmp 38 PID 1776 wrote to memory of 2468 1776 142C.tmp 38 PID 1776 wrote to memory of 2468 1776 142C.tmp 38 PID 2468 wrote to memory of 2624 2468 146B.tmp 39 PID 2468 wrote to memory of 2624 2468 146B.tmp 39 PID 2468 wrote to memory of 2624 2468 146B.tmp 39 PID 2468 wrote to memory of 2624 2468 146B.tmp 39 PID 2624 wrote to memory of 3012 2624 14C8.tmp 40 PID 2624 wrote to memory of 3012 2624 14C8.tmp 40 PID 2624 wrote to memory of 3012 2624 14C8.tmp 40 PID 2624 wrote to memory of 3012 2624 14C8.tmp 40 PID 3012 wrote to memory of 2964 3012 1516.tmp 41 PID 3012 wrote to memory of 2964 3012 1516.tmp 41 PID 3012 wrote to memory of 2964 3012 1516.tmp 41 PID 3012 wrote to memory of 2964 3012 1516.tmp 41 PID 2964 wrote to memory of 2684 2964 1584.tmp 42 PID 2964 wrote to memory of 2684 2964 1584.tmp 42 PID 2964 wrote to memory of 2684 2964 1584.tmp 42 PID 2964 wrote to memory of 2684 2964 1584.tmp 42 PID 2684 wrote to memory of 1088 2684 15E1.tmp 46 PID 2684 wrote to memory of 1088 2684 15E1.tmp 46 PID 2684 wrote to memory of 1088 2684 15E1.tmp 46 PID 2684 wrote to memory of 1088 2684 15E1.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_7b63c16fd32ece70b1322d85c46e1449_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812
-
-
-
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828
-
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"28⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"29⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"30⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"31⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"32⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"33⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"34⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"35⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"36⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"37⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"38⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"39⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"40⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"41⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"42⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"43⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"44⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"45⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"46⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"47⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"48⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"49⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"50⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"51⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"52⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"53⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"54⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"55⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"56⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"57⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"58⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"59⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"60⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"61⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"62⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"63⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"64⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"65⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"66⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"67⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"68⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"69⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"70⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"71⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"73⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"74⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"75⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"76⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"77⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"78⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"79⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"80⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"81⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"82⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"83⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"84⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"85⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"86⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"87⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"88⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"89⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"90⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"91⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"92⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"94⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"95⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"96⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"97⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"98⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"99⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"100⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"101⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"102⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"103⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"104⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"105⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"106⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"107⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"108⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"109⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"110⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"111⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"112⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"113⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"114⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"115⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"116⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"117⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"118⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"119⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"120⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"121⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"122⤵PID:2940
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-