Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe
-
Size
486KB
-
MD5
a95863f82c450264ba572a3e813c8007
-
SHA1
9ad8c0a79507057cc5808995485d3bbcb45934eb
-
SHA256
a21aef189049c13b1d3b8b79600f178eca6edc478d5c50eaf5dfd74d64f64747
-
SHA512
4a7792af5036fb1ee7dbde9bce4918db17fed5a0f1162fee4e34ffc3f974ffdcc6a88e09c82dcbdda66b0987c984a007e9fb271c0b6d4b3c339d5e8f347dfdcd
-
SSDEEP
12288:/U5rCOTeiD2VJ34sUphj1Cw0ei+yYUne1hhjNZ:/UQOJD2ssMhj1hyYzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2484 17B5.tmp 2736 1822.tmp 2608 1890.tmp 2396 18ED.tmp 872 195A.tmp 2568 19B8.tmp 2504 1A25.tmp 2400 1A92.tmp 2512 1AF0.tmp 2456 1B4E.tmp 884 1BBB.tmp 1616 1C18.tmp 2376 1C76.tmp 2716 1CE3.tmp 2704 1D50.tmp 1604 1DBE.tmp 1736 1E2B.tmp 2284 1E98.tmp 2280 1EF6.tmp 2204 1F53.tmp 1472 1FA1.tmp 1284 200E.tmp 2104 206C.tmp 3048 20BA.tmp 2064 2108.tmp 2372 2146.tmp 1852 2185.tmp 1228 21C3.tmp 592 2211.tmp 708 225F.tmp 1080 229E.tmp 1584 22EC.tmp 1760 233A.tmp 1168 2378.tmp 2940 23C6.tmp 1296 2404.tmp 2928 2443.tmp 2912 2481.tmp 692 24C0.tmp 1236 24FE.tmp 1968 254C.tmp 1312 259A.tmp 2968 25D8.tmp 288 2626.tmp 3000 2665.tmp 888 26A3.tmp 2008 26E2.tmp 900 2720.tmp 1452 275E.tmp 2232 27AC.tmp 1164 27FA.tmp 1444 2839.tmp 2472 2877.tmp 2164 28B6.tmp 2040 28F4.tmp 1644 2942.tmp 2948 2990.tmp 2500 29CE.tmp 2520 2A0D.tmp 2744 2A4B.tmp 2524 2A99.tmp 2548 2AE7.tmp 2652 2B26.tmp 2580 2B64.tmp -
Loads dropped DLL 64 IoCs
pid Process 2724 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 2484 17B5.tmp 2736 1822.tmp 2608 1890.tmp 2396 18ED.tmp 872 195A.tmp 2568 19B8.tmp 2504 1A25.tmp 2400 1A92.tmp 2512 1AF0.tmp 2456 1B4E.tmp 884 1BBB.tmp 1616 1C18.tmp 2376 1C76.tmp 2716 1CE3.tmp 2704 1D50.tmp 1604 1DBE.tmp 1736 1E2B.tmp 2284 1E98.tmp 2280 1EF6.tmp 2204 1F53.tmp 1472 1FA1.tmp 1284 200E.tmp 2104 206C.tmp 3048 20BA.tmp 2064 2108.tmp 2372 2146.tmp 1852 2185.tmp 1228 21C3.tmp 592 2211.tmp 708 225F.tmp 1080 229E.tmp 1584 22EC.tmp 1760 233A.tmp 1168 2378.tmp 2940 23C6.tmp 1296 2404.tmp 2928 2443.tmp 2912 2481.tmp 692 24C0.tmp 1236 24FE.tmp 1968 254C.tmp 1312 259A.tmp 2968 25D8.tmp 288 2626.tmp 3000 2665.tmp 888 26A3.tmp 2008 26E2.tmp 900 2720.tmp 1452 275E.tmp 2232 27AC.tmp 1164 27FA.tmp 1444 2839.tmp 2472 2877.tmp 2164 28B6.tmp 2040 28F4.tmp 1644 2942.tmp 2948 2990.tmp 2500 29CE.tmp 2520 2A0D.tmp 2744 2A4B.tmp 2524 2A99.tmp 2548 2AE7.tmp 2652 2B26.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2484 2724 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 28 PID 2724 wrote to memory of 2484 2724 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 28 PID 2724 wrote to memory of 2484 2724 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 28 PID 2724 wrote to memory of 2484 2724 2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe 28 PID 2484 wrote to memory of 2736 2484 17B5.tmp 29 PID 2484 wrote to memory of 2736 2484 17B5.tmp 29 PID 2484 wrote to memory of 2736 2484 17B5.tmp 29 PID 2484 wrote to memory of 2736 2484 17B5.tmp 29 PID 2736 wrote to memory of 2608 2736 1822.tmp 30 PID 2736 wrote to memory of 2608 2736 1822.tmp 30 PID 2736 wrote to memory of 2608 2736 1822.tmp 30 PID 2736 wrote to memory of 2608 2736 1822.tmp 30 PID 2608 wrote to memory of 2396 2608 1890.tmp 31 PID 2608 wrote to memory of 2396 2608 1890.tmp 31 PID 2608 wrote to memory of 2396 2608 1890.tmp 31 PID 2608 wrote to memory of 2396 2608 1890.tmp 31 PID 2396 wrote to memory of 872 2396 18ED.tmp 32 PID 2396 wrote to memory of 872 2396 18ED.tmp 32 PID 2396 wrote to memory of 872 2396 18ED.tmp 32 PID 2396 wrote to memory of 872 2396 18ED.tmp 32 PID 872 wrote to memory of 2568 872 195A.tmp 33 PID 872 wrote to memory of 2568 872 195A.tmp 33 PID 872 wrote to memory of 2568 872 195A.tmp 33 PID 872 wrote to memory of 2568 872 195A.tmp 33 PID 2568 wrote to memory of 2504 2568 19B8.tmp 34 PID 2568 wrote to memory of 2504 2568 19B8.tmp 34 PID 2568 wrote to memory of 2504 2568 19B8.tmp 34 PID 2568 wrote to memory of 2504 2568 19B8.tmp 34 PID 2504 wrote to memory of 2400 2504 1A25.tmp 35 PID 2504 wrote to memory of 2400 2504 1A25.tmp 35 PID 2504 wrote to memory of 2400 2504 1A25.tmp 35 PID 2504 wrote to memory of 2400 2504 1A25.tmp 35 PID 2400 wrote to memory of 2512 2400 1A92.tmp 36 PID 2400 wrote to memory of 2512 2400 1A92.tmp 36 PID 2400 wrote to memory of 2512 2400 1A92.tmp 36 PID 2400 wrote to memory of 2512 2400 1A92.tmp 36 PID 2512 wrote to memory of 2456 2512 1AF0.tmp 37 PID 2512 wrote to memory of 2456 2512 1AF0.tmp 37 PID 2512 wrote to memory of 2456 2512 1AF0.tmp 37 PID 2512 wrote to memory of 2456 2512 1AF0.tmp 37 PID 2456 wrote to memory of 884 2456 1B4E.tmp 38 PID 2456 wrote to memory of 884 2456 1B4E.tmp 38 PID 2456 wrote to memory of 884 2456 1B4E.tmp 38 PID 2456 wrote to memory of 884 2456 1B4E.tmp 38 PID 884 wrote to memory of 1616 884 1BBB.tmp 39 PID 884 wrote to memory of 1616 884 1BBB.tmp 39 PID 884 wrote to memory of 1616 884 1BBB.tmp 39 PID 884 wrote to memory of 1616 884 1BBB.tmp 39 PID 1616 wrote to memory of 2376 1616 1C18.tmp 40 PID 1616 wrote to memory of 2376 1616 1C18.tmp 40 PID 1616 wrote to memory of 2376 1616 1C18.tmp 40 PID 1616 wrote to memory of 2376 1616 1C18.tmp 40 PID 2376 wrote to memory of 2716 2376 1C76.tmp 41 PID 2376 wrote to memory of 2716 2376 1C76.tmp 41 PID 2376 wrote to memory of 2716 2376 1C76.tmp 41 PID 2376 wrote to memory of 2716 2376 1C76.tmp 41 PID 2716 wrote to memory of 2704 2716 1CE3.tmp 42 PID 2716 wrote to memory of 2704 2716 1CE3.tmp 42 PID 2716 wrote to memory of 2704 2716 1CE3.tmp 42 PID 2716 wrote to memory of 2704 2716 1CE3.tmp 42 PID 2704 wrote to memory of 1604 2704 1D50.tmp 43 PID 2704 wrote to memory of 1604 2704 1D50.tmp 43 PID 2704 wrote to memory of 1604 2704 1D50.tmp 43 PID 2704 wrote to memory of 1604 2704 1D50.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-07_a95863f82c450264ba572a3e813c8007_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"65⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"66⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"67⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"70⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"71⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"72⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"73⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"74⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"75⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"76⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"77⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"78⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"79⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"80⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"81⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"82⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"83⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"84⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"85⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"86⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"87⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"88⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"89⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"90⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"92⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"93⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"94⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"95⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"96⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"97⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"98⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"99⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"100⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"101⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"102⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"103⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"104⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"105⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"106⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"107⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"108⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"109⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"110⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"111⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"112⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"113⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"114⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"115⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"116⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"117⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"118⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"119⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"120⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"121⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-