Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 06:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe
-
Size
486KB
-
MD5
f1c3a04d2113c7864123141b9507e10d
-
SHA1
fabdf319e1b2c74a5af813a83a6a17161a36538f
-
SHA256
a06d9c84125ba68780ad0451d2364064f6793c79ebab70080f6f736180e6e45d
-
SHA512
6bbe254e063339dfe1bd1cfa57aed0e2e89afd43c558a8d6911c52eb08d75f212b5301de0aff614f0833be047de6a3f462c86cfe9196bcf42b3bbaf797f31ae0
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7C55KSIpeyZ+4n9k/7g2TMeIcNUepY8sH3dZ:/U5rCOTeiDCnysFznMNcNANZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3024 1796.tmp 2112 17E4.tmp 2088 1832.tmp 2564 1880.tmp 2660 18ED.tmp 2544 194B.tmp 2868 19A8.tmp 2828 1A06.tmp 1780 1A54.tmp 1656 1AC1.tmp 2484 1B1F.tmp 2952 1B7C.tmp 2236 1BDA.tmp 2832 1C38.tmp 2796 1C95.tmp 2928 1CF3.tmp 2752 1D50.tmp 2240 1DBE.tmp 1632 1E1B.tmp 1556 1E79.tmp 2704 1EC7.tmp 2784 1F24.tmp 1500 1F82.tmp 1524 1FD0.tmp 876 200E.tmp 2244 204D.tmp 2252 208B.tmp 2400 20D9.tmp 1916 2118.tmp 2900 2156.tmp 2116 2194.tmp 544 21E2.tmp 752 2221.tmp 592 225F.tmp 272 229E.tmp 1852 22EC.tmp 2968 232A.tmp 1944 2368.tmp 1744 23A7.tmp 1164 23F5.tmp 1416 2443.tmp 1372 2481.tmp 1668 24C0.tmp 1348 24FE.tmp 1036 254C.tmp 2912 258A.tmp 916 25C9.tmp 2320 2607.tmp 2040 2655.tmp 764 2694.tmp 2208 26D2.tmp 2248 2710.tmp 1508 274F.tmp 812 278D.tmp 2380 27CC.tmp 2924 280A.tmp 1600 2858.tmp 2852 2896.tmp 2744 28D5.tmp 3028 2923.tmp 2132 2971.tmp 2088 29BF.tmp 2564 29FD.tmp 2624 2A3C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2924 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 3024 1796.tmp 2112 17E4.tmp 2088 1832.tmp 2564 1880.tmp 2660 18ED.tmp 2544 194B.tmp 2868 19A8.tmp 2828 1A06.tmp 1780 1A54.tmp 1656 1AC1.tmp 2484 1B1F.tmp 2952 1B7C.tmp 2236 1BDA.tmp 2832 1C38.tmp 2796 1C95.tmp 2928 1CF3.tmp 2752 1D50.tmp 2240 1DBE.tmp 1632 1E1B.tmp 1556 1E79.tmp 2704 1EC7.tmp 2784 1F24.tmp 1500 1F82.tmp 1524 1FD0.tmp 876 200E.tmp 2244 204D.tmp 2252 208B.tmp 2400 20D9.tmp 1916 2118.tmp 2900 2156.tmp 2116 2194.tmp 544 21E2.tmp 752 2221.tmp 592 225F.tmp 272 229E.tmp 1852 22EC.tmp 2968 232A.tmp 1944 2368.tmp 1744 23A7.tmp 1164 23F5.tmp 1416 2443.tmp 1372 2481.tmp 1668 24C0.tmp 1348 24FE.tmp 1036 254C.tmp 2912 258A.tmp 916 25C9.tmp 2320 2607.tmp 2040 2655.tmp 764 2694.tmp 2208 26D2.tmp 2248 2710.tmp 1508 274F.tmp 812 278D.tmp 2380 27CC.tmp 2924 280A.tmp 1600 2858.tmp 2852 2896.tmp 2744 28D5.tmp 3028 2923.tmp 2132 2971.tmp 2088 29BF.tmp 2564 29FD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3024 2924 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 28 PID 2924 wrote to memory of 3024 2924 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 28 PID 2924 wrote to memory of 3024 2924 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 28 PID 2924 wrote to memory of 3024 2924 2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe 28 PID 3024 wrote to memory of 2112 3024 1796.tmp 29 PID 3024 wrote to memory of 2112 3024 1796.tmp 29 PID 3024 wrote to memory of 2112 3024 1796.tmp 29 PID 3024 wrote to memory of 2112 3024 1796.tmp 29 PID 2112 wrote to memory of 2088 2112 17E4.tmp 30 PID 2112 wrote to memory of 2088 2112 17E4.tmp 30 PID 2112 wrote to memory of 2088 2112 17E4.tmp 30 PID 2112 wrote to memory of 2088 2112 17E4.tmp 30 PID 2088 wrote to memory of 2564 2088 1832.tmp 31 PID 2088 wrote to memory of 2564 2088 1832.tmp 31 PID 2088 wrote to memory of 2564 2088 1832.tmp 31 PID 2088 wrote to memory of 2564 2088 1832.tmp 31 PID 2564 wrote to memory of 2660 2564 1880.tmp 32 PID 2564 wrote to memory of 2660 2564 1880.tmp 32 PID 2564 wrote to memory of 2660 2564 1880.tmp 32 PID 2564 wrote to memory of 2660 2564 1880.tmp 32 PID 2660 wrote to memory of 2544 2660 18ED.tmp 33 PID 2660 wrote to memory of 2544 2660 18ED.tmp 33 PID 2660 wrote to memory of 2544 2660 18ED.tmp 33 PID 2660 wrote to memory of 2544 2660 18ED.tmp 33 PID 2544 wrote to memory of 2868 2544 194B.tmp 34 PID 2544 wrote to memory of 2868 2544 194B.tmp 34 PID 2544 wrote to memory of 2868 2544 194B.tmp 34 PID 2544 wrote to memory of 2868 2544 194B.tmp 34 PID 2868 wrote to memory of 2828 2868 19A8.tmp 35 PID 2868 wrote to memory of 2828 2868 19A8.tmp 35 PID 2868 wrote to memory of 2828 2868 19A8.tmp 35 PID 2868 wrote to memory of 2828 2868 19A8.tmp 35 PID 2828 wrote to memory of 1780 2828 1A06.tmp 36 PID 2828 wrote to memory of 1780 2828 1A06.tmp 36 PID 2828 wrote to memory of 1780 2828 1A06.tmp 36 PID 2828 wrote to memory of 1780 2828 1A06.tmp 36 PID 1780 wrote to memory of 1656 1780 1A54.tmp 37 PID 1780 wrote to memory of 1656 1780 1A54.tmp 37 PID 1780 wrote to memory of 1656 1780 1A54.tmp 37 PID 1780 wrote to memory of 1656 1780 1A54.tmp 37 PID 1656 wrote to memory of 2484 1656 1AC1.tmp 38 PID 1656 wrote to memory of 2484 1656 1AC1.tmp 38 PID 1656 wrote to memory of 2484 1656 1AC1.tmp 38 PID 1656 wrote to memory of 2484 1656 1AC1.tmp 38 PID 2484 wrote to memory of 2952 2484 1B1F.tmp 39 PID 2484 wrote to memory of 2952 2484 1B1F.tmp 39 PID 2484 wrote to memory of 2952 2484 1B1F.tmp 39 PID 2484 wrote to memory of 2952 2484 1B1F.tmp 39 PID 2952 wrote to memory of 2236 2952 1B7C.tmp 40 PID 2952 wrote to memory of 2236 2952 1B7C.tmp 40 PID 2952 wrote to memory of 2236 2952 1B7C.tmp 40 PID 2952 wrote to memory of 2236 2952 1B7C.tmp 40 PID 2236 wrote to memory of 2832 2236 1BDA.tmp 41 PID 2236 wrote to memory of 2832 2236 1BDA.tmp 41 PID 2236 wrote to memory of 2832 2236 1BDA.tmp 41 PID 2236 wrote to memory of 2832 2236 1BDA.tmp 41 PID 2832 wrote to memory of 2796 2832 1C38.tmp 42 PID 2832 wrote to memory of 2796 2832 1C38.tmp 42 PID 2832 wrote to memory of 2796 2832 1C38.tmp 42 PID 2832 wrote to memory of 2796 2832 1C38.tmp 42 PID 2796 wrote to memory of 2928 2796 1C95.tmp 43 PID 2796 wrote to memory of 2928 2796 1C95.tmp 43 PID 2796 wrote to memory of 2928 2796 1C95.tmp 43 PID 2796 wrote to memory of 2928 2796 1C95.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_f1c3a04d2113c7864123141b9507e10d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"65⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"66⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"67⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"68⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"70⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"71⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"72⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"73⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"74⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"75⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"76⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"77⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"78⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"80⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"82⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"83⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"84⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"85⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"86⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"87⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"89⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"90⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"91⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"92⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"93⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"94⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"95⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"96⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"97⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"98⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"99⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"100⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"101⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"102⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"103⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"104⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"105⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"106⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"107⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"108⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"110⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"111⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"113⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"114⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"115⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"116⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"117⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"118⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"120⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"121⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-