Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 06:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe
-
Size
486KB
-
MD5
f31a762c1c143aaae409be4793345eef
-
SHA1
2b06c352ee5726173aae9a1d5245fdbb8328b2c4
-
SHA256
103d3a3579a5493a66f0816b56ee67642842dce473765ad8bad83888f4ab274e
-
SHA512
bd4cf9ba01be176dd7d3c90dbee12ba23f3b5c058cb341f4f22a196a26d96a98143ca62278781c98391e4a7cde6bf1f4505b1f1c998d41968113a90f1240ab9c
-
SSDEEP
12288:/U5rCOTeiDn/geGPMEQS++h9PhcOY7YuNZ:/UQOJD/geGPsS+q9PNY71N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 944 7ED.tmp 2032 85A.tmp 1420 8F6.tmp 2676 973.tmp 2672 9F0.tmp 2148 A5D.tmp 2780 ACA.tmp 2952 B28.tmp 2524 B95.tmp 2512 C02.tmp 2536 C50.tmp 1104 CBD.tmp 956 D2A.tmp 2864 D78.tmp 964 DE6.tmp 1288 E34.tmp 2520 E91.tmp 2456 EDF.tmp 2840 F1E.tmp 824 F6C.tmp 1616 FBA.tmp 1796 1046.tmp 2120 1094.tmp 3064 10D2.tmp 1312 1120.tmp 2452 116E.tmp 2268 11BC.tmp 324 120A.tmp 684 1268.tmp 2912 12C6.tmp 304 1323.tmp 1496 1381.tmp 1900 13CF.tmp 620 141D.tmp 2612 146B.tmp 1988 14B9.tmp 856 1507.tmp 1520 1545.tmp 3020 1593.tmp 1884 15E1.tmp 2000 1620.tmp 1240 166E.tmp 1668 16BC.tmp 1224 16FA.tmp 1076 1738.tmp 1176 1786.tmp 2888 17D4.tmp 2348 1813.tmp 2992 1851.tmp 2192 1890.tmp 1108 18DE.tmp 1788 191C.tmp 2172 195A.tmp 2080 1999.tmp 2244 19D7.tmp 1388 1A16.tmp 3036 1A54.tmp 2556 1AA2.tmp 3016 1AE0.tmp 2688 1B1F.tmp 2680 1B5D.tmp 2884 1B9C.tmp 2596 1BDA.tmp 2880 1C18.tmp -
Loads dropped DLL 64 IoCs
pid Process 2956 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 944 7ED.tmp 2032 85A.tmp 1420 8F6.tmp 2676 973.tmp 2672 9F0.tmp 2148 A5D.tmp 2780 ACA.tmp 2952 B28.tmp 2524 B95.tmp 2512 C02.tmp 2536 C50.tmp 1104 CBD.tmp 956 D2A.tmp 2864 D78.tmp 964 DE6.tmp 1288 E34.tmp 2520 E91.tmp 2456 EDF.tmp 2840 F1E.tmp 824 F6C.tmp 1616 FBA.tmp 1796 1046.tmp 2120 1094.tmp 3064 10D2.tmp 1312 1120.tmp 2452 116E.tmp 2268 11BC.tmp 324 120A.tmp 684 1268.tmp 2912 12C6.tmp 304 1323.tmp 1496 1381.tmp 1900 13CF.tmp 620 141D.tmp 2612 146B.tmp 1988 14B9.tmp 856 1507.tmp 1520 1545.tmp 3020 1593.tmp 1884 15E1.tmp 2000 1620.tmp 1240 166E.tmp 1668 16BC.tmp 1224 16FA.tmp 1076 1738.tmp 1176 1786.tmp 2888 17D4.tmp 2348 1813.tmp 2992 1851.tmp 2192 1890.tmp 1108 18DE.tmp 1788 191C.tmp 2172 195A.tmp 2080 1999.tmp 2244 19D7.tmp 1388 1A16.tmp 3036 1A54.tmp 2556 1AA2.tmp 3016 1AE0.tmp 2688 1B1F.tmp 2680 1B5D.tmp 2884 1B9C.tmp 2596 1BDA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2956 wrote to memory of 944 2956 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 28 PID 2956 wrote to memory of 944 2956 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 28 PID 2956 wrote to memory of 944 2956 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 28 PID 2956 wrote to memory of 944 2956 2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe 28 PID 944 wrote to memory of 2032 944 7ED.tmp 29 PID 944 wrote to memory of 2032 944 7ED.tmp 29 PID 944 wrote to memory of 2032 944 7ED.tmp 29 PID 944 wrote to memory of 2032 944 7ED.tmp 29 PID 2032 wrote to memory of 1420 2032 85A.tmp 30 PID 2032 wrote to memory of 1420 2032 85A.tmp 30 PID 2032 wrote to memory of 1420 2032 85A.tmp 30 PID 2032 wrote to memory of 1420 2032 85A.tmp 30 PID 1420 wrote to memory of 2676 1420 8F6.tmp 31 PID 1420 wrote to memory of 2676 1420 8F6.tmp 31 PID 1420 wrote to memory of 2676 1420 8F6.tmp 31 PID 1420 wrote to memory of 2676 1420 8F6.tmp 31 PID 2676 wrote to memory of 2672 2676 973.tmp 32 PID 2676 wrote to memory of 2672 2676 973.tmp 32 PID 2676 wrote to memory of 2672 2676 973.tmp 32 PID 2676 wrote to memory of 2672 2676 973.tmp 32 PID 2672 wrote to memory of 2148 2672 9F0.tmp 33 PID 2672 wrote to memory of 2148 2672 9F0.tmp 33 PID 2672 wrote to memory of 2148 2672 9F0.tmp 33 PID 2672 wrote to memory of 2148 2672 9F0.tmp 33 PID 2148 wrote to memory of 2780 2148 A5D.tmp 34 PID 2148 wrote to memory of 2780 2148 A5D.tmp 34 PID 2148 wrote to memory of 2780 2148 A5D.tmp 34 PID 2148 wrote to memory of 2780 2148 A5D.tmp 34 PID 2780 wrote to memory of 2952 2780 ACA.tmp 35 PID 2780 wrote to memory of 2952 2780 ACA.tmp 35 PID 2780 wrote to memory of 2952 2780 ACA.tmp 35 PID 2780 wrote to memory of 2952 2780 ACA.tmp 35 PID 2952 wrote to memory of 2524 2952 B28.tmp 36 PID 2952 wrote to memory of 2524 2952 B28.tmp 36 PID 2952 wrote to memory of 2524 2952 B28.tmp 36 PID 2952 wrote to memory of 2524 2952 B28.tmp 36 PID 2524 wrote to memory of 2512 2524 B95.tmp 37 PID 2524 wrote to memory of 2512 2524 B95.tmp 37 PID 2524 wrote to memory of 2512 2524 B95.tmp 37 PID 2524 wrote to memory of 2512 2524 B95.tmp 37 PID 2512 wrote to memory of 2536 2512 C02.tmp 38 PID 2512 wrote to memory of 2536 2512 C02.tmp 38 PID 2512 wrote to memory of 2536 2512 C02.tmp 38 PID 2512 wrote to memory of 2536 2512 C02.tmp 38 PID 2536 wrote to memory of 1104 2536 C50.tmp 39 PID 2536 wrote to memory of 1104 2536 C50.tmp 39 PID 2536 wrote to memory of 1104 2536 C50.tmp 39 PID 2536 wrote to memory of 1104 2536 C50.tmp 39 PID 1104 wrote to memory of 956 1104 CBD.tmp 40 PID 1104 wrote to memory of 956 1104 CBD.tmp 40 PID 1104 wrote to memory of 956 1104 CBD.tmp 40 PID 1104 wrote to memory of 956 1104 CBD.tmp 40 PID 956 wrote to memory of 2864 956 D2A.tmp 41 PID 956 wrote to memory of 2864 956 D2A.tmp 41 PID 956 wrote to memory of 2864 956 D2A.tmp 41 PID 956 wrote to memory of 2864 956 D2A.tmp 41 PID 2864 wrote to memory of 964 2864 D78.tmp 42 PID 2864 wrote to memory of 964 2864 D78.tmp 42 PID 2864 wrote to memory of 964 2864 D78.tmp 42 PID 2864 wrote to memory of 964 2864 D78.tmp 42 PID 964 wrote to memory of 1288 964 DE6.tmp 43 PID 964 wrote to memory of 1288 964 DE6.tmp 43 PID 964 wrote to memory of 1288 964 DE6.tmp 43 PID 964 wrote to memory of 1288 964 DE6.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-14_f31a762c1c143aaae409be4793345eef_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"65⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"66⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"68⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"70⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"72⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"73⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"74⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"75⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"76⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"77⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"79⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"80⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"81⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"82⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"83⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"84⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"85⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"86⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"87⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"88⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"90⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"91⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"92⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"93⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"94⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"95⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"96⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"97⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"98⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"99⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"100⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"101⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"102⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"104⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"105⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"106⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"107⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"108⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"109⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"110⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"111⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"113⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"114⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"116⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"117⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"118⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"119⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"120⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-