Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23/02/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe
-
Size
520KB
-
MD5
d685d9a0c2f948366d5be46f29bb9394
-
SHA1
2b8ca70912d3021bc465f8bfc08c2e6c81235159
-
SHA256
11e4085c0e17bd26cb971f68d06109d0e42c099e630c09fa3782e77279ea4b3e
-
SHA512
a727eb9b9ca5764eb67c1aa8667bdd1673bd3dd74f67b550d628a1eef747525c9add938da7835e17e3bb7077d4f8d8f403c05ca37b15dc9e142138911582da83
-
SSDEEP
12288:gj8fuxR21t5i8fqRCSVxb33E/8MuzJ15lJVoNZ:gj8fuK1GYqTVxb30/DuzoN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2936 1C95.tmp 2832 1CD4.tmp 2492 1D50.tmp 2572 1DAE.tmp 2476 1E1B.tmp 2360 1E79.tmp 2188 1ED6.tmp 1652 1F34.tmp 2408 1F92.tmp 2424 1FFF.tmp 2396 205C.tmp 2324 20CA.tmp 2096 2146.tmp 348 21C3.tmp 2440 2221.tmp 1728 228E.tmp 312 22FB.tmp 2088 2359.tmp 2132 23C6.tmp 2184 2424.tmp 2036 2491.tmp 1152 24EE.tmp 1688 253C.tmp 2820 258A.tmp 2692 25C9.tmp 2004 2617.tmp 3060 2655.tmp 1912 2694.tmp 1320 26D2.tmp 788 2710.tmp 576 274F.tmp 1404 278D.tmp 1612 27CC.tmp 1696 281A.tmp 2308 2868.tmp 916 28A6.tmp 2940 28E4.tmp 1640 2932.tmp 2720 2971.tmp 1884 29AF.tmp 1596 29EE.tmp 1256 2A2C.tmp 816 2A6A.tmp 1956 2AA9.tmp 884 2AE7.tmp 2928 2B26.tmp 1932 2B64.tmp 2172 2BB2.tmp 776 2BF0.tmp 2916 2C2F.tmp 988 2C6D.tmp 1944 2CAC.tmp 876 2CEA.tmp 1860 2D28.tmp 1500 2D67.tmp 1532 2DA5.tmp 2688 2DE4.tmp 2936 2E22.tmp 2900 2E60.tmp 2552 2EAE.tmp 2492 2EED.tmp 2576 2F2B.tmp 2600 2F89.tmp 2296 2FC7.tmp -
Loads dropped DLL 64 IoCs
pid Process 1540 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 2936 1C95.tmp 2832 1CD4.tmp 2492 1D50.tmp 2572 1DAE.tmp 2476 1E1B.tmp 2360 1E79.tmp 2188 1ED6.tmp 1652 1F34.tmp 2408 1F92.tmp 2424 1FFF.tmp 2396 205C.tmp 2324 20CA.tmp 2096 2146.tmp 348 21C3.tmp 2440 2221.tmp 1728 228E.tmp 312 22FB.tmp 2088 2359.tmp 2132 23C6.tmp 2184 2424.tmp 2036 2491.tmp 1152 24EE.tmp 1688 253C.tmp 2820 258A.tmp 2692 25C9.tmp 2004 2617.tmp 3060 2655.tmp 1912 2694.tmp 1320 26D2.tmp 788 2710.tmp 576 274F.tmp 1404 278D.tmp 1612 27CC.tmp 1696 281A.tmp 2308 2868.tmp 916 28A6.tmp 2940 28E4.tmp 1640 2932.tmp 2720 2971.tmp 1884 29AF.tmp 1596 29EE.tmp 1256 2A2C.tmp 816 2A6A.tmp 1956 2AA9.tmp 884 2AE7.tmp 2928 2B26.tmp 1932 2B64.tmp 2172 2BB2.tmp 776 2BF0.tmp 2916 2C2F.tmp 988 2C6D.tmp 1944 2CAC.tmp 876 2CEA.tmp 1860 2D28.tmp 1500 2D67.tmp 1532 2DA5.tmp 2688 2DE4.tmp 2936 2E22.tmp 2900 2E60.tmp 2552 2EAE.tmp 2492 2EED.tmp 2576 2F2B.tmp 2600 2F89.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2936 1540 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 28 PID 1540 wrote to memory of 2936 1540 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 28 PID 1540 wrote to memory of 2936 1540 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 28 PID 1540 wrote to memory of 2936 1540 2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe 28 PID 2936 wrote to memory of 2832 2936 1C95.tmp 29 PID 2936 wrote to memory of 2832 2936 1C95.tmp 29 PID 2936 wrote to memory of 2832 2936 1C95.tmp 29 PID 2936 wrote to memory of 2832 2936 1C95.tmp 29 PID 2832 wrote to memory of 2492 2832 1CD4.tmp 30 PID 2832 wrote to memory of 2492 2832 1CD4.tmp 30 PID 2832 wrote to memory of 2492 2832 1CD4.tmp 30 PID 2832 wrote to memory of 2492 2832 1CD4.tmp 30 PID 2492 wrote to memory of 2572 2492 1D50.tmp 31 PID 2492 wrote to memory of 2572 2492 1D50.tmp 31 PID 2492 wrote to memory of 2572 2492 1D50.tmp 31 PID 2492 wrote to memory of 2572 2492 1D50.tmp 31 PID 2572 wrote to memory of 2476 2572 1DAE.tmp 32 PID 2572 wrote to memory of 2476 2572 1DAE.tmp 32 PID 2572 wrote to memory of 2476 2572 1DAE.tmp 32 PID 2572 wrote to memory of 2476 2572 1DAE.tmp 32 PID 2476 wrote to memory of 2360 2476 1E1B.tmp 33 PID 2476 wrote to memory of 2360 2476 1E1B.tmp 33 PID 2476 wrote to memory of 2360 2476 1E1B.tmp 33 PID 2476 wrote to memory of 2360 2476 1E1B.tmp 33 PID 2360 wrote to memory of 2188 2360 1E79.tmp 34 PID 2360 wrote to memory of 2188 2360 1E79.tmp 34 PID 2360 wrote to memory of 2188 2360 1E79.tmp 34 PID 2360 wrote to memory of 2188 2360 1E79.tmp 34 PID 2188 wrote to memory of 1652 2188 1ED6.tmp 35 PID 2188 wrote to memory of 1652 2188 1ED6.tmp 35 PID 2188 wrote to memory of 1652 2188 1ED6.tmp 35 PID 2188 wrote to memory of 1652 2188 1ED6.tmp 35 PID 1652 wrote to memory of 2408 1652 1F34.tmp 36 PID 1652 wrote to memory of 2408 1652 1F34.tmp 36 PID 1652 wrote to memory of 2408 1652 1F34.tmp 36 PID 1652 wrote to memory of 2408 1652 1F34.tmp 36 PID 2408 wrote to memory of 2424 2408 1F92.tmp 37 PID 2408 wrote to memory of 2424 2408 1F92.tmp 37 PID 2408 wrote to memory of 2424 2408 1F92.tmp 37 PID 2408 wrote to memory of 2424 2408 1F92.tmp 37 PID 2424 wrote to memory of 2396 2424 1FFF.tmp 38 PID 2424 wrote to memory of 2396 2424 1FFF.tmp 38 PID 2424 wrote to memory of 2396 2424 1FFF.tmp 38 PID 2424 wrote to memory of 2396 2424 1FFF.tmp 38 PID 2396 wrote to memory of 2324 2396 205C.tmp 39 PID 2396 wrote to memory of 2324 2396 205C.tmp 39 PID 2396 wrote to memory of 2324 2396 205C.tmp 39 PID 2396 wrote to memory of 2324 2396 205C.tmp 39 PID 2324 wrote to memory of 2096 2324 20CA.tmp 40 PID 2324 wrote to memory of 2096 2324 20CA.tmp 40 PID 2324 wrote to memory of 2096 2324 20CA.tmp 40 PID 2324 wrote to memory of 2096 2324 20CA.tmp 40 PID 2096 wrote to memory of 348 2096 2146.tmp 41 PID 2096 wrote to memory of 348 2096 2146.tmp 41 PID 2096 wrote to memory of 348 2096 2146.tmp 41 PID 2096 wrote to memory of 348 2096 2146.tmp 41 PID 348 wrote to memory of 2440 348 21C3.tmp 42 PID 348 wrote to memory of 2440 348 21C3.tmp 42 PID 348 wrote to memory of 2440 348 21C3.tmp 42 PID 348 wrote to memory of 2440 348 21C3.tmp 42 PID 2440 wrote to memory of 1728 2440 2221.tmp 43 PID 2440 wrote to memory of 1728 2440 2221.tmp 43 PID 2440 wrote to memory of 1728 2440 2221.tmp 43 PID 2440 wrote to memory of 1728 2440 2221.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_d685d9a0c2f948366d5be46f29bb9394_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"65⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"66⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"67⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"68⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"69⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"70⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"71⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"72⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"73⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"74⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"75⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"76⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"77⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"78⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"79⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"80⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"81⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"82⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"83⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"84⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"85⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"86⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"87⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"88⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"89⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"90⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"91⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"92⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"93⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"94⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"95⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"96⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"97⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"98⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"99⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"100⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"101⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"102⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"103⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"104⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"105⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"106⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"107⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"108⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"109⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"110⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"111⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"112⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"114⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"116⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"117⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"118⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"119⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"121⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"122⤵PID:1860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-