Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe
-
Size
486KB
-
MD5
8ca138a5dcbc83776cd967aa73689b2a
-
SHA1
2dc6fda14c500039fb0e120721e8304c7181f7b2
-
SHA256
f83fbc950cdbf44f7b65dda33403ec84217f7f9d07b6b4bcff1673afb93c6f2d
-
SHA512
bf27251d6c56ced6bad0ffbb860f431f03c98e2862fa2fd2c3edd669eb92823e50c1e5797da3521df5ccd972dca56ab68aa6a96f225f33fe785cf70f178ca39e
-
SSDEEP
12288:oU5rCOTeiDPK27rRDKHMIztF+C6oygYcE6fJkXNZ:oUQOJDPKMMP27omWJkXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2752 6E4.tmp 1616 751.tmp 2100 7CE.tmp 3036 83B.tmp 2676 898.tmp 2868 906.tmp 2584 973.tmp 2736 9E0.tmp 2732 A3E.tmp 2472 A9B.tmp 2544 B08.tmp 3048 B66.tmp 3000 BC4.tmp 2952 C21.tmp 1300 C7F.tmp 1076 CDC.tmp 1444 D3A.tmp 2556 D88.tmp 2936 DE6.tmp 2124 E53.tmp 1608 EC0.tmp 1628 F2D.tmp 2064 F7B.tmp 1328 FC9.tmp 2276 1008.tmp 1200 1056.tmp 1980 1094.tmp 856 10E2.tmp 268 1130.tmp 336 117E.tmp 1168 11CC.tmp 1624 121A.tmp 1712 1258.tmp 564 1297.tmp 1640 12D5.tmp 1912 1314.tmp 844 1352.tmp 1088 1390.tmp 1936 13CF.tmp 1372 141D.tmp 1532 145B.tmp 1368 149A.tmp 1036 14D8.tmp 1884 1526.tmp 912 1564.tmp 1988 15A3.tmp 1632 15E1.tmp 2232 1620.tmp 1644 165E.tmp 2244 169C.tmp 2208 16DB.tmp 2444 1719.tmp 892 1767.tmp 812 17A6.tmp 2432 17E4.tmp 2748 1822.tmp 1592 1861.tmp 2856 189F.tmp 2752 18DE.tmp 1508 191C.tmp 2340 195A.tmp 2612 1999.tmp 2664 19D7.tmp 2696 1A16.tmp -
Loads dropped DLL 64 IoCs
pid Process 2548 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 2752 6E4.tmp 1616 751.tmp 2100 7CE.tmp 3036 83B.tmp 2676 898.tmp 2868 906.tmp 2584 973.tmp 2736 9E0.tmp 2732 A3E.tmp 2472 A9B.tmp 2544 B08.tmp 3048 B66.tmp 3000 BC4.tmp 2952 C21.tmp 1300 C7F.tmp 1076 CDC.tmp 1444 D3A.tmp 2556 D88.tmp 2936 DE6.tmp 2124 E53.tmp 1608 EC0.tmp 1628 F2D.tmp 2064 F7B.tmp 1328 FC9.tmp 2276 1008.tmp 1200 1056.tmp 1980 1094.tmp 856 10E2.tmp 268 1130.tmp 336 117E.tmp 1168 11CC.tmp 1624 121A.tmp 1712 1258.tmp 564 1297.tmp 1640 12D5.tmp 1912 1314.tmp 844 1352.tmp 1088 1390.tmp 1936 13CF.tmp 1372 141D.tmp 1532 145B.tmp 1368 149A.tmp 1036 14D8.tmp 1884 1526.tmp 912 1564.tmp 1988 15A3.tmp 1632 15E1.tmp 2232 1620.tmp 1644 165E.tmp 2244 169C.tmp 2208 16DB.tmp 2444 1719.tmp 892 1767.tmp 812 17A6.tmp 2432 17E4.tmp 2748 1822.tmp 1592 1861.tmp 2856 189F.tmp 2752 18DE.tmp 1508 191C.tmp 2340 195A.tmp 2612 1999.tmp 2664 19D7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2752 2548 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe 28 PID 2752 wrote to memory of 1616 2752 6E4.tmp 29 PID 2752 wrote to memory of 1616 2752 6E4.tmp 29 PID 2752 wrote to memory of 1616 2752 6E4.tmp 29 PID 2752 wrote to memory of 1616 2752 6E4.tmp 29 PID 1616 wrote to memory of 2100 1616 751.tmp 30 PID 1616 wrote to memory of 2100 1616 751.tmp 30 PID 1616 wrote to memory of 2100 1616 751.tmp 30 PID 1616 wrote to memory of 2100 1616 751.tmp 30 PID 2100 wrote to memory of 3036 2100 7CE.tmp 31 PID 2100 wrote to memory of 3036 2100 7CE.tmp 31 PID 2100 wrote to memory of 3036 2100 7CE.tmp 31 PID 2100 wrote to memory of 3036 2100 7CE.tmp 31 PID 3036 wrote to memory of 2676 3036 83B.tmp 32 PID 3036 wrote to memory of 2676 3036 83B.tmp 32 PID 3036 wrote to memory of 2676 3036 83B.tmp 32 PID 3036 wrote to memory of 2676 3036 83B.tmp 32 PID 2676 wrote to memory of 2868 2676 898.tmp 33 PID 2676 wrote to memory of 2868 2676 898.tmp 33 PID 2676 wrote to memory of 2868 2676 898.tmp 33 PID 2676 wrote to memory of 2868 2676 898.tmp 33 PID 2868 wrote to memory of 2584 2868 906.tmp 34 PID 2868 wrote to memory of 2584 2868 906.tmp 34 PID 2868 wrote to memory of 2584 2868 906.tmp 34 PID 2868 wrote to memory of 2584 2868 906.tmp 34 PID 2584 wrote to memory of 2736 2584 973.tmp 35 PID 2584 wrote to memory of 2736 2584 973.tmp 35 PID 2584 wrote to memory of 2736 2584 973.tmp 35 PID 2584 wrote to memory of 2736 2584 973.tmp 35 PID 2736 wrote to memory of 2732 2736 9E0.tmp 36 PID 2736 wrote to memory of 2732 2736 9E0.tmp 36 PID 2736 wrote to memory of 2732 2736 9E0.tmp 36 PID 2736 wrote to memory of 2732 2736 9E0.tmp 36 PID 2732 wrote to memory of 2472 2732 A3E.tmp 37 PID 2732 wrote to memory of 2472 2732 A3E.tmp 37 PID 2732 wrote to memory of 2472 2732 A3E.tmp 37 PID 2732 wrote to memory of 2472 2732 A3E.tmp 37 PID 2472 wrote to memory of 2544 2472 A9B.tmp 38 PID 2472 wrote to memory of 2544 2472 A9B.tmp 38 PID 2472 wrote to memory of 2544 2472 A9B.tmp 38 PID 2472 wrote to memory of 2544 2472 A9B.tmp 38 PID 2544 wrote to memory of 3048 2544 B08.tmp 39 PID 2544 wrote to memory of 3048 2544 B08.tmp 39 PID 2544 wrote to memory of 3048 2544 B08.tmp 39 PID 2544 wrote to memory of 3048 2544 B08.tmp 39 PID 3048 wrote to memory of 3000 3048 B66.tmp 40 PID 3048 wrote to memory of 3000 3048 B66.tmp 40 PID 3048 wrote to memory of 3000 3048 B66.tmp 40 PID 3048 wrote to memory of 3000 3048 B66.tmp 40 PID 3000 wrote to memory of 2952 3000 BC4.tmp 41 PID 3000 wrote to memory of 2952 3000 BC4.tmp 41 PID 3000 wrote to memory of 2952 3000 BC4.tmp 41 PID 3000 wrote to memory of 2952 3000 BC4.tmp 41 PID 2952 wrote to memory of 1300 2952 C21.tmp 42 PID 2952 wrote to memory of 1300 2952 C21.tmp 42 PID 2952 wrote to memory of 1300 2952 C21.tmp 42 PID 2952 wrote to memory of 1300 2952 C21.tmp 42 PID 1300 wrote to memory of 1076 1300 C7F.tmp 43 PID 1300 wrote to memory of 1076 1300 C7F.tmp 43 PID 1300 wrote to memory of 1076 1300 C7F.tmp 43 PID 1300 wrote to memory of 1076 1300 C7F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_8ca138a5dcbc83776cd967aa73689b2a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"66⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"67⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"68⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"69⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"70⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"71⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"72⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"73⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"74⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"75⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"77⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"78⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"79⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"80⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"81⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"82⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"83⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"85⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"86⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"87⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"88⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"89⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"90⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"91⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"92⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"93⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"94⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"95⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"96⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"97⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"98⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"99⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"100⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"101⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"103⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"104⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"105⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"106⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"107⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"108⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"109⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"110⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"111⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"112⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"113⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"114⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"115⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"116⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"117⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"118⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"119⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"120⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"121⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-