Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe
-
Size
520KB
-
MD5
8e8385958034812bd7f8ff358d788a3e
-
SHA1
70b91bf6ce07ddfad4bf25ade6a97985141855ad
-
SHA256
ffd16416288fa2be7ad7da8fbe39e042a4fd40c18095f163d3f7c20cf9e1b148
-
SHA512
599463276e2abb09e1bc01d66a6f296f350da9a7656250dee28876922567332e3c46e356df7e40ac295d9de95c847bf53295ed60b62f6b961856ae3c1dfeb966
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLfDGdZHtqvGhZdr/HGepSlyv3Avy8WoqWrDajI:roRXOQjmOy0ZNpj/mep+yvdrkcUhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2220 122A.tmp 2000 1287.tmp 2364 1323.tmp 2172 1390.tmp 2544 142C.tmp 2656 149A.tmp 2608 1516.tmp 2916 1564.tmp 2112 15D2.tmp 2868 164E.tmp 2156 16BC.tmp 2464 170A.tmp 292 1777.tmp 2620 17D4.tmp 2792 1842.tmp 2872 18AF.tmp 2804 191C.tmp 2840 1989.tmp 2692 19F6.tmp 2772 1A54.tmp 2988 1AC1.tmp 300 1B1F.tmp 1628 1B5D.tmp 2248 1BAB.tmp 1044 1BEA.tmp 1792 1C38.tmp 1432 1C86.tmp 2356 1CC4.tmp 2200 1D02.tmp 2412 1D50.tmp 684 1D9E.tmp 924 1DDD.tmp 1496 1E2B.tmp 1756 1E79.tmp 564 1ED6.tmp 1868 1F24.tmp 648 1F63.tmp 1752 1FB1.tmp 2924 1FEF.tmp 2944 202E.tmp 1352 206C.tmp 2028 20AA.tmp 788 20E9.tmp 1168 2137.tmp 1964 2175.tmp 1856 21C3.tmp 2308 2202.tmp 2072 2240.tmp 2380 227E.tmp 1256 22BD.tmp 2932 230B.tmp 2060 2349.tmp 1520 2397.tmp 2188 23D6.tmp 1616 2424.tmp 2280 2462.tmp 312 24A0.tmp 2220 24DF.tmp 280 252D.tmp 1048 256B.tmp 2372 25AA.tmp 2104 25E8.tmp 2596 2626.tmp 2680 2665.tmp -
Loads dropped DLL 64 IoCs
pid Process 1304 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 2220 122A.tmp 2000 1287.tmp 2364 1323.tmp 2172 1390.tmp 2544 142C.tmp 2656 149A.tmp 2608 1516.tmp 2916 1564.tmp 2112 15D2.tmp 2868 164E.tmp 2156 16BC.tmp 2464 170A.tmp 292 1777.tmp 2620 17D4.tmp 2792 1842.tmp 2872 18AF.tmp 2804 191C.tmp 2840 1989.tmp 2692 19F6.tmp 2772 1A54.tmp 2988 1AC1.tmp 300 1B1F.tmp 1628 1B5D.tmp 2248 1BAB.tmp 1044 1BEA.tmp 1792 1C38.tmp 1432 1C86.tmp 2356 1CC4.tmp 2200 1D02.tmp 2412 1D50.tmp 684 1D9E.tmp 924 1DDD.tmp 1496 1E2B.tmp 1756 1E79.tmp 564 1ED6.tmp 1868 1F24.tmp 648 1F63.tmp 1752 1FB1.tmp 2924 1FEF.tmp 2944 202E.tmp 1352 206C.tmp 2028 20AA.tmp 788 20E9.tmp 1168 2137.tmp 1964 2175.tmp 1856 21C3.tmp 2308 2202.tmp 2072 2240.tmp 2380 227E.tmp 1256 22BD.tmp 2932 230B.tmp 2060 2349.tmp 1520 2397.tmp 2188 23D6.tmp 1616 2424.tmp 2280 2462.tmp 312 24A0.tmp 2220 24DF.tmp 280 252D.tmp 1048 256B.tmp 2372 25AA.tmp 2104 25E8.tmp 2596 2626.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2220 1304 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 28 PID 1304 wrote to memory of 2220 1304 2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe 28 PID 2220 wrote to memory of 2000 2220 122A.tmp 29 PID 2220 wrote to memory of 2000 2220 122A.tmp 29 PID 2220 wrote to memory of 2000 2220 122A.tmp 29 PID 2220 wrote to memory of 2000 2220 122A.tmp 29 PID 2000 wrote to memory of 2364 2000 1287.tmp 30 PID 2000 wrote to memory of 2364 2000 1287.tmp 30 PID 2000 wrote to memory of 2364 2000 1287.tmp 30 PID 2000 wrote to memory of 2364 2000 1287.tmp 30 PID 2364 wrote to memory of 2172 2364 1323.tmp 31 PID 2364 wrote to memory of 2172 2364 1323.tmp 31 PID 2364 wrote to memory of 2172 2364 1323.tmp 31 PID 2364 wrote to memory of 2172 2364 1323.tmp 31 PID 2172 wrote to memory of 2544 2172 1390.tmp 32 PID 2172 wrote to memory of 2544 2172 1390.tmp 32 PID 2172 wrote to memory of 2544 2172 1390.tmp 32 PID 2172 wrote to memory of 2544 2172 1390.tmp 32 PID 2544 wrote to memory of 2656 2544 142C.tmp 33 PID 2544 wrote to memory of 2656 2544 142C.tmp 33 PID 2544 wrote to memory of 2656 2544 142C.tmp 33 PID 2544 wrote to memory of 2656 2544 142C.tmp 33 PID 2656 wrote to memory of 2608 2656 149A.tmp 34 PID 2656 wrote to memory of 2608 2656 149A.tmp 34 PID 2656 wrote to memory of 2608 2656 149A.tmp 34 PID 2656 wrote to memory of 2608 2656 149A.tmp 34 PID 2608 wrote to memory of 2916 2608 1516.tmp 35 PID 2608 wrote to memory of 2916 2608 1516.tmp 35 PID 2608 wrote to memory of 2916 2608 1516.tmp 35 PID 2608 wrote to memory of 2916 2608 1516.tmp 35 PID 2916 wrote to memory of 2112 2916 1564.tmp 36 PID 2916 wrote to memory of 2112 2916 1564.tmp 36 PID 2916 wrote to memory of 2112 2916 1564.tmp 36 PID 2916 wrote to memory of 2112 2916 1564.tmp 36 PID 2112 wrote to memory of 2868 2112 15D2.tmp 37 PID 2112 wrote to memory of 2868 2112 15D2.tmp 37 PID 2112 wrote to memory of 2868 2112 15D2.tmp 37 PID 2112 wrote to memory of 2868 2112 15D2.tmp 37 PID 2868 wrote to memory of 2156 2868 164E.tmp 38 PID 2868 wrote to memory of 2156 2868 164E.tmp 38 PID 2868 wrote to memory of 2156 2868 164E.tmp 38 PID 2868 wrote to memory of 2156 2868 164E.tmp 38 PID 2156 wrote to memory of 2464 2156 16BC.tmp 39 PID 2156 wrote to memory of 2464 2156 16BC.tmp 39 PID 2156 wrote to memory of 2464 2156 16BC.tmp 39 PID 2156 wrote to memory of 2464 2156 16BC.tmp 39 PID 2464 wrote to memory of 292 2464 170A.tmp 40 PID 2464 wrote to memory of 292 2464 170A.tmp 40 PID 2464 wrote to memory of 292 2464 170A.tmp 40 PID 2464 wrote to memory of 292 2464 170A.tmp 40 PID 292 wrote to memory of 2620 292 1777.tmp 41 PID 292 wrote to memory of 2620 292 1777.tmp 41 PID 292 wrote to memory of 2620 292 1777.tmp 41 PID 292 wrote to memory of 2620 292 1777.tmp 41 PID 2620 wrote to memory of 2792 2620 17D4.tmp 42 PID 2620 wrote to memory of 2792 2620 17D4.tmp 42 PID 2620 wrote to memory of 2792 2620 17D4.tmp 42 PID 2620 wrote to memory of 2792 2620 17D4.tmp 42 PID 2792 wrote to memory of 2872 2792 1842.tmp 43 PID 2792 wrote to memory of 2872 2792 1842.tmp 43 PID 2792 wrote to memory of 2872 2792 1842.tmp 43 PID 2792 wrote to memory of 2872 2792 1842.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-18_8e8385958034812bd7f8ff358d788a3e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"66⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"67⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"68⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"69⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"70⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"72⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"73⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"74⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"75⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"76⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"77⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"78⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"79⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"80⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"81⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"82⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"83⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"84⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"85⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"87⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"88⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"89⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"90⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"91⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"92⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"94⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"95⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"96⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"97⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"98⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"99⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"100⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"101⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"102⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"103⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"105⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"106⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"108⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"110⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"111⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"112⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"113⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"114⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"115⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"116⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"119⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"120⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"121⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-