Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 20:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe
-
Size
765KB
-
MD5
d093b66eda8e856ef353c4064eb5b4d2
-
SHA1
c03e04f7d16dbc6a71f31810fb5fbfc164e99e9e
-
SHA256
8318c7e2cb36ab80454671947b172c79836e5013ed95e635137efee8d93d24fe
-
SHA512
710ecc0a7384c30a804bdfdf20c318929af2a1f91e4011c7a4a3545b744367a5e5992a7aa00641a037e30185f0e2e3e2d567fb201d22136b8dbe9cc68e623ee9
-
SSDEEP
12288:ZU5rCOTeiDeoN1MxAiNdu6ibI7262fOX3ZF5rn5rLOa54U5w5A:ZUQOJDFN1M/vu6i8TX3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2064 9D0.tmp 2752 A1E.tmp 2140 A9B.tmp 2624 B08.tmp 2692 B76.tmp 3064 BC4.tmp 2596 C02.tmp 2496 C50.tmp 340 CBD.tmp 2484 D2A.tmp 2588 D98.tmp 2072 DE6.tmp 2168 E34.tmp 2816 E72.tmp 2952 ED0.tmp 1812 F3D.tmp 1668 F8B.tmp 1436 FF8.tmp 1740 1075.tmp 2528 10E2.tmp 2772 114F.tmp 1560 11BC.tmp 2412 121A.tmp 1500 1258.tmp 1276 1297.tmp 2056 12D5.tmp 2244 1314.tmp 2448 1362.tmp 2164 13A0.tmp 1964 13EE.tmp 700 142C.tmp 988 147A.tmp 1484 14B9.tmp 1476 1507.tmp 1772 1555.tmp 2336 1593.tmp 1868 15D2.tmp 452 1610.tmp 1048 164E.tmp 2116 168D.tmp 1564 16CB.tmp 1924 170A.tmp 1628 1748.tmp 2876 1786.tmp 1040 17C5.tmp 908 1803.tmp 560 1842.tmp 840 1880.tmp 2228 18BE.tmp 1808 18FD.tmp 1784 193B.tmp 2904 197A.tmp 1504 19B8.tmp 1764 1A06.tmp 2144 1A44.tmp 1712 1A83.tmp 1756 1AC1.tmp 2268 1B00.tmp 3068 1B3E.tmp 2612 1B7C.tmp 2084 1BBB.tmp 2676 1BF9.tmp 2872 1C38.tmp 2584 1C76.tmp -
Loads dropped DLL 64 IoCs
pid Process 1756 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 2064 9D0.tmp 2752 A1E.tmp 2140 A9B.tmp 2624 B08.tmp 2692 B76.tmp 3064 BC4.tmp 2596 C02.tmp 2496 C50.tmp 340 CBD.tmp 2484 D2A.tmp 2588 D98.tmp 2072 DE6.tmp 2168 E34.tmp 2816 E72.tmp 2952 ED0.tmp 1812 F3D.tmp 1668 F8B.tmp 1436 FF8.tmp 1740 1075.tmp 2528 10E2.tmp 2772 114F.tmp 1560 11BC.tmp 2412 121A.tmp 1500 1258.tmp 1276 1297.tmp 2056 12D5.tmp 2244 1314.tmp 2448 1362.tmp 2164 13A0.tmp 1964 13EE.tmp 700 142C.tmp 988 147A.tmp 1484 14B9.tmp 1476 1507.tmp 1772 1555.tmp 2336 1593.tmp 1868 15D2.tmp 452 1610.tmp 1048 164E.tmp 2116 168D.tmp 1564 16CB.tmp 1924 170A.tmp 1628 1748.tmp 2876 1786.tmp 1040 17C5.tmp 908 1803.tmp 560 1842.tmp 840 1880.tmp 2228 18BE.tmp 1808 18FD.tmp 1784 193B.tmp 2904 197A.tmp 1504 19B8.tmp 1764 1A06.tmp 2144 1A44.tmp 1712 1A83.tmp 1756 1AC1.tmp 2268 1B00.tmp 3068 1B3E.tmp 2612 1B7C.tmp 2084 1BBB.tmp 2676 1BF9.tmp 2872 1C38.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 2064 1756 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 28 PID 1756 wrote to memory of 2064 1756 2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe 28 PID 2064 wrote to memory of 2752 2064 9D0.tmp 29 PID 2064 wrote to memory of 2752 2064 9D0.tmp 29 PID 2064 wrote to memory of 2752 2064 9D0.tmp 29 PID 2064 wrote to memory of 2752 2064 9D0.tmp 29 PID 2752 wrote to memory of 2140 2752 A1E.tmp 30 PID 2752 wrote to memory of 2140 2752 A1E.tmp 30 PID 2752 wrote to memory of 2140 2752 A1E.tmp 30 PID 2752 wrote to memory of 2140 2752 A1E.tmp 30 PID 2140 wrote to memory of 2624 2140 A9B.tmp 31 PID 2140 wrote to memory of 2624 2140 A9B.tmp 31 PID 2140 wrote to memory of 2624 2140 A9B.tmp 31 PID 2140 wrote to memory of 2624 2140 A9B.tmp 31 PID 2624 wrote to memory of 2692 2624 B08.tmp 32 PID 2624 wrote to memory of 2692 2624 B08.tmp 32 PID 2624 wrote to memory of 2692 2624 B08.tmp 32 PID 2624 wrote to memory of 2692 2624 B08.tmp 32 PID 2692 wrote to memory of 3064 2692 B76.tmp 33 PID 2692 wrote to memory of 3064 2692 B76.tmp 33 PID 2692 wrote to memory of 3064 2692 B76.tmp 33 PID 2692 wrote to memory of 3064 2692 B76.tmp 33 PID 3064 wrote to memory of 2596 3064 BC4.tmp 34 PID 3064 wrote to memory of 2596 3064 BC4.tmp 34 PID 3064 wrote to memory of 2596 3064 BC4.tmp 34 PID 3064 wrote to memory of 2596 3064 BC4.tmp 34 PID 2596 wrote to memory of 2496 2596 C02.tmp 35 PID 2596 wrote to memory of 2496 2596 C02.tmp 35 PID 2596 wrote to memory of 2496 2596 C02.tmp 35 PID 2596 wrote to memory of 2496 2596 C02.tmp 35 PID 2496 wrote to memory of 340 2496 C50.tmp 36 PID 2496 wrote to memory of 340 2496 C50.tmp 36 PID 2496 wrote to memory of 340 2496 C50.tmp 36 PID 2496 wrote to memory of 340 2496 C50.tmp 36 PID 340 wrote to memory of 2484 340 CBD.tmp 37 PID 340 wrote to memory of 2484 340 CBD.tmp 37 PID 340 wrote to memory of 2484 340 CBD.tmp 37 PID 340 wrote to memory of 2484 340 CBD.tmp 37 PID 2484 wrote to memory of 2588 2484 D2A.tmp 38 PID 2484 wrote to memory of 2588 2484 D2A.tmp 38 PID 2484 wrote to memory of 2588 2484 D2A.tmp 38 PID 2484 wrote to memory of 2588 2484 D2A.tmp 38 PID 2588 wrote to memory of 2072 2588 D98.tmp 39 PID 2588 wrote to memory of 2072 2588 D98.tmp 39 PID 2588 wrote to memory of 2072 2588 D98.tmp 39 PID 2588 wrote to memory of 2072 2588 D98.tmp 39 PID 2072 wrote to memory of 2168 2072 DE6.tmp 40 PID 2072 wrote to memory of 2168 2072 DE6.tmp 40 PID 2072 wrote to memory of 2168 2072 DE6.tmp 40 PID 2072 wrote to memory of 2168 2072 DE6.tmp 40 PID 2168 wrote to memory of 2816 2168 E34.tmp 41 PID 2168 wrote to memory of 2816 2168 E34.tmp 41 PID 2168 wrote to memory of 2816 2168 E34.tmp 41 PID 2168 wrote to memory of 2816 2168 E34.tmp 41 PID 2816 wrote to memory of 2952 2816 E72.tmp 42 PID 2816 wrote to memory of 2952 2816 E72.tmp 42 PID 2816 wrote to memory of 2952 2816 E72.tmp 42 PID 2816 wrote to memory of 2952 2816 E72.tmp 42 PID 2952 wrote to memory of 1812 2952 ED0.tmp 43 PID 2952 wrote to memory of 1812 2952 ED0.tmp 43 PID 2952 wrote to memory of 1812 2952 ED0.tmp 43 PID 2952 wrote to memory of 1812 2952 ED0.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_d093b66eda8e856ef353c4064eb5b4d2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"65⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"66⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"67⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"68⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"71⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"72⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"74⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"75⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"76⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"78⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"79⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"81⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"82⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"83⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"85⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"87⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"88⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"89⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"90⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"91⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"92⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"93⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"94⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"95⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"96⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"98⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"99⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"100⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"101⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"102⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"103⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"104⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"105⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"106⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"107⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"108⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"110⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"111⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"112⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"113⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"114⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"115⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"116⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"117⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"118⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"119⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"120⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"121⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"122⤵PID:1880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-