Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
Resource
win10v2004-20240220-en
General
-
Target
2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe
-
Size
541KB
-
MD5
ec0f25182c3df9a6f025720ec972b40a
-
SHA1
c280f8977b4ef031e23a1f7a0f5f5f93924f4635
-
SHA256
8f06747dfa85cbef167100484c4f93d6f39572d23ce5b2e5880ac2da8e44cdbb
-
SHA512
4637aaa62d9fe5a94c3afa52b447b2ecfabf10f46a04324f44d08cec1a8a08c95bdf277948d8f8c79f99c36db65b7e4eec3c92454261a4dfa71728676701b0e8
-
SSDEEP
12288:UU5rCOTeifVfZ9B8mZkLgtNaTlKiZHbJeKsaoq2rZa73ctO:UUQOJfVjB8XculKiZ4hBfrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 500 F8B.tmp 1028 FE8.tmp 2560 1065.tmp 2612 10C3.tmp 2724 1130.tmp 2592 119D.tmp 2752 11FB.tmp 2896 1249.tmp 2512 12B6.tmp 2476 1314.tmp 2588 1381.tmp 2100 13DE.tmp 304 145B.tmp 2836 14B9.tmp 2892 1507.tmp 1668 1564.tmp 1716 15D2.tmp 2648 1620.tmp 700 167D.tmp 2556 16EA.tmp 2684 1758.tmp 3040 17C5.tmp 3032 1822.tmp 1620 1870.tmp 2564 18AF.tmp 3056 18ED.tmp 2444 192C.tmp 2644 196A.tmp 2940 19A8.tmp 1436 19E7.tmp 324 1A25.tmp 796 1A64.tmp 1052 1AA2.tmp 1044 1AE0.tmp 596 1B2E.tmp 1804 1B6D.tmp 1780 1BAB.tmp 3008 1BF9.tmp 2140 1C38.tmp 1756 1C76.tmp 1528 1CB4.tmp 1776 1CF3.tmp 1604 1D31.tmp 1868 1D70.tmp 2964 1DBE.tmp 920 1DFC.tmp 632 1E3A.tmp 1700 1E79.tmp 2336 1EC7.tmp 2216 1F05.tmp 844 1F44.tmp 2304 1F82.tmp 2388 1FC0.tmp 2144 1FFF.tmp 1584 203D.tmp 1312 207C.tmp 2420 20BA.tmp 1032 20F8.tmp 2784 2137.tmp 2320 2185.tmp 2064 21C3.tmp 2616 2211.tmp 2596 2250.tmp 2724 22AD.tmp -
Loads dropped DLL 64 IoCs
pid Process 2328 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 500 F8B.tmp 1028 FE8.tmp 2560 1065.tmp 2612 10C3.tmp 2724 1130.tmp 2592 119D.tmp 2752 11FB.tmp 2896 1249.tmp 2512 12B6.tmp 2476 1314.tmp 2588 1381.tmp 2100 13DE.tmp 304 145B.tmp 2836 14B9.tmp 2892 1507.tmp 1668 1564.tmp 1716 15D2.tmp 2648 1620.tmp 700 167D.tmp 2556 16EA.tmp 2684 1758.tmp 3040 17C5.tmp 3032 1822.tmp 1620 1870.tmp 2564 18AF.tmp 3056 18ED.tmp 2444 192C.tmp 2644 196A.tmp 2940 19A8.tmp 1436 19E7.tmp 324 1A25.tmp 796 1A64.tmp 1052 1AA2.tmp 1044 1AE0.tmp 596 1B2E.tmp 1804 1B6D.tmp 1780 1BAB.tmp 3008 1BF9.tmp 2140 1C38.tmp 1756 1C76.tmp 1528 1CB4.tmp 1776 1CF3.tmp 1604 1D31.tmp 1868 1D70.tmp 2964 1DBE.tmp 920 1DFC.tmp 632 1E3A.tmp 1700 1E79.tmp 2336 1EC7.tmp 2216 1F05.tmp 844 1F44.tmp 2304 1F82.tmp 2388 1FC0.tmp 2144 1FFF.tmp 1584 203D.tmp 1312 207C.tmp 2420 20BA.tmp 1032 20F8.tmp 2784 2137.tmp 2320 2185.tmp 2064 21C3.tmp 2616 2211.tmp 2596 2250.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 500 2328 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 28 PID 2328 wrote to memory of 500 2328 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 28 PID 2328 wrote to memory of 500 2328 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 28 PID 2328 wrote to memory of 500 2328 2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe 28 PID 500 wrote to memory of 1028 500 F8B.tmp 29 PID 500 wrote to memory of 1028 500 F8B.tmp 29 PID 500 wrote to memory of 1028 500 F8B.tmp 29 PID 500 wrote to memory of 1028 500 F8B.tmp 29 PID 1028 wrote to memory of 2560 1028 FE8.tmp 30 PID 1028 wrote to memory of 2560 1028 FE8.tmp 30 PID 1028 wrote to memory of 2560 1028 FE8.tmp 30 PID 1028 wrote to memory of 2560 1028 FE8.tmp 30 PID 2560 wrote to memory of 2612 2560 1065.tmp 31 PID 2560 wrote to memory of 2612 2560 1065.tmp 31 PID 2560 wrote to memory of 2612 2560 1065.tmp 31 PID 2560 wrote to memory of 2612 2560 1065.tmp 31 PID 2612 wrote to memory of 2724 2612 10C3.tmp 32 PID 2612 wrote to memory of 2724 2612 10C3.tmp 32 PID 2612 wrote to memory of 2724 2612 10C3.tmp 32 PID 2612 wrote to memory of 2724 2612 10C3.tmp 32 PID 2724 wrote to memory of 2592 2724 1130.tmp 33 PID 2724 wrote to memory of 2592 2724 1130.tmp 33 PID 2724 wrote to memory of 2592 2724 1130.tmp 33 PID 2724 wrote to memory of 2592 2724 1130.tmp 33 PID 2592 wrote to memory of 2752 2592 119D.tmp 34 PID 2592 wrote to memory of 2752 2592 119D.tmp 34 PID 2592 wrote to memory of 2752 2592 119D.tmp 34 PID 2592 wrote to memory of 2752 2592 119D.tmp 34 PID 2752 wrote to memory of 2896 2752 11FB.tmp 35 PID 2752 wrote to memory of 2896 2752 11FB.tmp 35 PID 2752 wrote to memory of 2896 2752 11FB.tmp 35 PID 2752 wrote to memory of 2896 2752 11FB.tmp 35 PID 2896 wrote to memory of 2512 2896 1249.tmp 36 PID 2896 wrote to memory of 2512 2896 1249.tmp 36 PID 2896 wrote to memory of 2512 2896 1249.tmp 36 PID 2896 wrote to memory of 2512 2896 1249.tmp 36 PID 2512 wrote to memory of 2476 2512 12B6.tmp 37 PID 2512 wrote to memory of 2476 2512 12B6.tmp 37 PID 2512 wrote to memory of 2476 2512 12B6.tmp 37 PID 2512 wrote to memory of 2476 2512 12B6.tmp 37 PID 2476 wrote to memory of 2588 2476 1314.tmp 38 PID 2476 wrote to memory of 2588 2476 1314.tmp 38 PID 2476 wrote to memory of 2588 2476 1314.tmp 38 PID 2476 wrote to memory of 2588 2476 1314.tmp 38 PID 2588 wrote to memory of 2100 2588 1381.tmp 39 PID 2588 wrote to memory of 2100 2588 1381.tmp 39 PID 2588 wrote to memory of 2100 2588 1381.tmp 39 PID 2588 wrote to memory of 2100 2588 1381.tmp 39 PID 2100 wrote to memory of 304 2100 13DE.tmp 40 PID 2100 wrote to memory of 304 2100 13DE.tmp 40 PID 2100 wrote to memory of 304 2100 13DE.tmp 40 PID 2100 wrote to memory of 304 2100 13DE.tmp 40 PID 304 wrote to memory of 2836 304 145B.tmp 41 PID 304 wrote to memory of 2836 304 145B.tmp 41 PID 304 wrote to memory of 2836 304 145B.tmp 41 PID 304 wrote to memory of 2836 304 145B.tmp 41 PID 2836 wrote to memory of 2892 2836 14B9.tmp 42 PID 2836 wrote to memory of 2892 2836 14B9.tmp 42 PID 2836 wrote to memory of 2892 2836 14B9.tmp 42 PID 2836 wrote to memory of 2892 2836 14B9.tmp 42 PID 2892 wrote to memory of 1668 2892 1507.tmp 43 PID 2892 wrote to memory of 1668 2892 1507.tmp 43 PID 2892 wrote to memory of 1668 2892 1507.tmp 43 PID 2892 wrote to memory of 1668 2892 1507.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ec0f25182c3df9a6f025720ec972b40a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"65⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"66⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"67⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"68⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"70⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"72⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"74⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"75⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"76⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"77⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"78⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"79⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"80⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"81⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"83⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"84⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"85⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"87⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"88⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"89⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"90⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"91⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"93⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"94⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"95⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"96⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"98⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"99⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"100⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"101⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"102⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"103⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"104⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"106⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"107⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"108⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"110⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"111⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"112⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"113⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"114⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"115⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"116⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"117⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"118⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"119⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"120⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"121⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-