Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 10:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe
-
Size
527KB
-
MD5
4ed525f5f4493a8cf51499774ba454b9
-
SHA1
ac01e5482386ab4e987a9f41dab228924bda86e9
-
SHA256
91bbcd15503bc90d5b15e18ce3fcf5df8b2ba53708d2b03e993633f68e20ecaf
-
SHA512
a4bbb1d60be3b99b564a7b15d1a39421215a105174f50bcc84ca9c22eb4a977e6e97898098c2a720effb1e175af5130cc6b66537294cc7328a927fecbae4a128
-
SSDEEP
12288:fU5rCOTeid0POwjPNmhUg/nESdmT1xcTugL5DZu:fUQOJd05DYUgP8T1xW9Do
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2800 13B0.tmp 2992 140D.tmp 2568 148A.tmp 2716 14F7.tmp 1472 1564.tmp 2732 15D2.tmp 2948 162F.tmp 2652 169C.tmp 2436 1719.tmp 2588 1786.tmp 1668 17F4.tmp 2616 1851.tmp 2700 18AF.tmp 2788 191C.tmp 1720 197A.tmp 2044 19E7.tmp 2304 1A54.tmp 1760 1AC1.tmp 892 1B1F.tmp 1204 1B7C.tmp 2460 1BDA.tmp 1240 1C47.tmp 1704 1CA5.tmp 2516 1CE3.tmp 880 1D31.tmp 1748 1D70.tmp 2832 1DAE.tmp 824 1DEC.tmp 1728 1E2B.tmp 604 1E69.tmp 560 1EB7.tmp 580 1F05.tmp 1048 1F44.tmp 1740 1F82.tmp 1800 1FC0.tmp 628 1FFF.tmp 1684 203D.tmp 708 207C.tmp 1028 20BA.tmp 1152 2108.tmp 1284 2146.tmp 1488 2194.tmp 1304 21D3.tmp 1936 2211.tmp 2340 2250.tmp 936 228E.tmp 1688 22CC.tmp 2796 231A.tmp 2156 2368.tmp 2176 23B6.tmp 1656 23F5.tmp 2500 2433.tmp 2052 2472.tmp 2188 24B0.tmp 3064 24EE.tmp 1548 252D.tmp 2908 256B.tmp 2612 25B9.tmp 1580 25F8.tmp 2564 2636.tmp 2648 2674.tmp 2572 26B3.tmp 2536 26F1.tmp 2456 2730.tmp -
Loads dropped DLL 64 IoCs
pid Process 2320 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 2800 13B0.tmp 2992 140D.tmp 2568 148A.tmp 2716 14F7.tmp 1472 1564.tmp 2732 15D2.tmp 2948 162F.tmp 2652 169C.tmp 2436 1719.tmp 2588 1786.tmp 1668 17F4.tmp 2616 1851.tmp 2700 18AF.tmp 2788 191C.tmp 1720 197A.tmp 2044 19E7.tmp 2304 1A54.tmp 1760 1AC1.tmp 892 1B1F.tmp 1204 1B7C.tmp 2460 1BDA.tmp 1240 1C47.tmp 1704 1CA5.tmp 2516 1CE3.tmp 880 1D31.tmp 1748 1D70.tmp 2832 1DAE.tmp 824 1DEC.tmp 1728 1E2B.tmp 604 1E69.tmp 560 1EB7.tmp 580 1F05.tmp 1048 1F44.tmp 1740 1F82.tmp 1800 1FC0.tmp 628 1FFF.tmp 1684 203D.tmp 708 207C.tmp 1028 20BA.tmp 1152 2108.tmp 1284 2146.tmp 1488 2194.tmp 1304 21D3.tmp 1936 2211.tmp 2340 2250.tmp 936 228E.tmp 1688 22CC.tmp 2796 231A.tmp 2156 2368.tmp 2176 23B6.tmp 1656 23F5.tmp 2500 2433.tmp 2052 2472.tmp 2188 24B0.tmp 3064 24EE.tmp 1548 252D.tmp 2908 256B.tmp 2612 25B9.tmp 1580 25F8.tmp 2564 2636.tmp 2648 2674.tmp 2572 26B3.tmp 2536 26F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2800 2320 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 28 PID 2320 wrote to memory of 2800 2320 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 28 PID 2320 wrote to memory of 2800 2320 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 28 PID 2320 wrote to memory of 2800 2320 2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe 28 PID 2800 wrote to memory of 2992 2800 13B0.tmp 29 PID 2800 wrote to memory of 2992 2800 13B0.tmp 29 PID 2800 wrote to memory of 2992 2800 13B0.tmp 29 PID 2800 wrote to memory of 2992 2800 13B0.tmp 29 PID 2992 wrote to memory of 2568 2992 140D.tmp 30 PID 2992 wrote to memory of 2568 2992 140D.tmp 30 PID 2992 wrote to memory of 2568 2992 140D.tmp 30 PID 2992 wrote to memory of 2568 2992 140D.tmp 30 PID 2568 wrote to memory of 2716 2568 148A.tmp 31 PID 2568 wrote to memory of 2716 2568 148A.tmp 31 PID 2568 wrote to memory of 2716 2568 148A.tmp 31 PID 2568 wrote to memory of 2716 2568 148A.tmp 31 PID 2716 wrote to memory of 1472 2716 14F7.tmp 32 PID 2716 wrote to memory of 1472 2716 14F7.tmp 32 PID 2716 wrote to memory of 1472 2716 14F7.tmp 32 PID 2716 wrote to memory of 1472 2716 14F7.tmp 32 PID 1472 wrote to memory of 2732 1472 1564.tmp 33 PID 1472 wrote to memory of 2732 1472 1564.tmp 33 PID 1472 wrote to memory of 2732 1472 1564.tmp 33 PID 1472 wrote to memory of 2732 1472 1564.tmp 33 PID 2732 wrote to memory of 2948 2732 15D2.tmp 34 PID 2732 wrote to memory of 2948 2732 15D2.tmp 34 PID 2732 wrote to memory of 2948 2732 15D2.tmp 34 PID 2732 wrote to memory of 2948 2732 15D2.tmp 34 PID 2948 wrote to memory of 2652 2948 162F.tmp 35 PID 2948 wrote to memory of 2652 2948 162F.tmp 35 PID 2948 wrote to memory of 2652 2948 162F.tmp 35 PID 2948 wrote to memory of 2652 2948 162F.tmp 35 PID 2652 wrote to memory of 2436 2652 169C.tmp 36 PID 2652 wrote to memory of 2436 2652 169C.tmp 36 PID 2652 wrote to memory of 2436 2652 169C.tmp 36 PID 2652 wrote to memory of 2436 2652 169C.tmp 36 PID 2436 wrote to memory of 2588 2436 1719.tmp 37 PID 2436 wrote to memory of 2588 2436 1719.tmp 37 PID 2436 wrote to memory of 2588 2436 1719.tmp 37 PID 2436 wrote to memory of 2588 2436 1719.tmp 37 PID 2588 wrote to memory of 1668 2588 1786.tmp 38 PID 2588 wrote to memory of 1668 2588 1786.tmp 38 PID 2588 wrote to memory of 1668 2588 1786.tmp 38 PID 2588 wrote to memory of 1668 2588 1786.tmp 38 PID 1668 wrote to memory of 2616 1668 17F4.tmp 39 PID 1668 wrote to memory of 2616 1668 17F4.tmp 39 PID 1668 wrote to memory of 2616 1668 17F4.tmp 39 PID 1668 wrote to memory of 2616 1668 17F4.tmp 39 PID 2616 wrote to memory of 2700 2616 1851.tmp 40 PID 2616 wrote to memory of 2700 2616 1851.tmp 40 PID 2616 wrote to memory of 2700 2616 1851.tmp 40 PID 2616 wrote to memory of 2700 2616 1851.tmp 40 PID 2700 wrote to memory of 2788 2700 18AF.tmp 41 PID 2700 wrote to memory of 2788 2700 18AF.tmp 41 PID 2700 wrote to memory of 2788 2700 18AF.tmp 41 PID 2700 wrote to memory of 2788 2700 18AF.tmp 41 PID 2788 wrote to memory of 1720 2788 191C.tmp 42 PID 2788 wrote to memory of 1720 2788 191C.tmp 42 PID 2788 wrote to memory of 1720 2788 191C.tmp 42 PID 2788 wrote to memory of 1720 2788 191C.tmp 42 PID 1720 wrote to memory of 2044 1720 197A.tmp 43 PID 1720 wrote to memory of 2044 1720 197A.tmp 43 PID 1720 wrote to memory of 2044 1720 197A.tmp 43 PID 1720 wrote to memory of 2044 1720 197A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_4ed525f5f4493a8cf51499774ba454b9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"65⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"66⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"67⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"68⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"70⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"71⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"72⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"73⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"74⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"75⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"76⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"77⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"79⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"80⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"81⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"82⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"83⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"85⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"86⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"87⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"88⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"89⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"90⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"91⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"92⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"93⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"94⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"95⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"97⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"98⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"100⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"101⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"102⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"103⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"105⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"106⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"107⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"108⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"109⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"110⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"111⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"112⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"113⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"114⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"115⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"116⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"117⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"118⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"119⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"120⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"121⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-