Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe
-
Size
536KB
-
MD5
67662be4c708150e64a5eb2477800db4
-
SHA1
6a7b6e386cfd5803a3ec327bfb31ad1f9ca2963f
-
SHA256
adbffad102f40ff5721e0bef209453286a7aa2ea336571491a2373f80aab7594
-
SHA512
625f8f44837fc8624ee62fbca2f4a81473d66f47c411afcbc8a0377c59df015b4a7c5a7bfd3643a254a091dec5015897dd5e4fb203af14e55adc6a4d1311310d
-
SSDEEP
12288:wU5rCOTeiUcvNFjWelMaefpeTUMQGMOwWvmf+pKIZxVJ0ZT9:wUQOJUMFSelFeBQUMtWWvE+gIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1280 6E4.tmp 2356 760.tmp 1272 7FC.tmp 2652 879.tmp 2816 8D7.tmp 2732 954.tmp 2764 A0F.tmp 300 ABA.tmp 2528 B85.tmp 2520 BF2.tmp 2340 C50.tmp 2860 CAE.tmp 2172 D3A.tmp 1888 DE6.tmp 1896 E24.tmp 1660 EA1.tmp 1424 F7B.tmp 1576 1008.tmp 2272 10C3.tmp 1964 1140.tmp 2432 11AD.tmp 540 1249.tmp 1484 12F4.tmp 1644 1333.tmp 1836 1371.tmp 692 13B0.tmp 1124 13EE.tmp 2132 145B.tmp 1884 149A.tmp 964 14D8.tmp 3068 1536.tmp 1664 1584.tmp 704 1620.tmp 1904 165E.tmp 836 169C.tmp 2220 16DB.tmp 1196 1738.tmp 1872 1777.tmp 1600 1803.tmp 2296 1851.tmp 2372 1890.tmp 2740 18CE.tmp 2180 190C.tmp 2612 195A.tmp 848 1999.tmp 2696 19D7.tmp 2648 1A16.tmp 2928 1A64.tmp 2724 1AC1.tmp 2764 1B00.tmp 2624 1B3E.tmp 2504 1B7C.tmp 2892 1BBB.tmp 2128 1C09.tmp 2632 1C38.tmp 1032 1C76.tmp 1816 1CB4.tmp 2172 1D22.tmp 344 1D50.tmp 2412 1D8F.tmp 1896 1DBE.tmp 2512 1DFC.tmp 1612 1E3A.tmp 1580 1E88.tmp -
Loads dropped DLL 64 IoCs
pid Process 2868 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 1280 6E4.tmp 2356 760.tmp 1272 7FC.tmp 2652 879.tmp 2816 8D7.tmp 2732 954.tmp 2764 A0F.tmp 300 ABA.tmp 2528 B85.tmp 2520 BF2.tmp 2340 C50.tmp 2860 CAE.tmp 2172 D3A.tmp 1888 DE6.tmp 1896 E24.tmp 1660 EA1.tmp 1424 F7B.tmp 1576 1008.tmp 2272 10C3.tmp 1964 1140.tmp 2432 11AD.tmp 540 1249.tmp 1484 12F4.tmp 1644 1333.tmp 1836 1371.tmp 692 13B0.tmp 1124 13EE.tmp 2132 145B.tmp 1884 149A.tmp 964 14D8.tmp 3068 1536.tmp 1664 1584.tmp 704 1620.tmp 1904 165E.tmp 836 169C.tmp 2220 16DB.tmp 1196 1738.tmp 1872 1777.tmp 1600 1803.tmp 2296 1851.tmp 2372 1890.tmp 2740 18CE.tmp 2180 190C.tmp 2612 195A.tmp 848 1999.tmp 2696 19D7.tmp 2648 1A16.tmp 2928 1A64.tmp 2724 1AC1.tmp 2764 1B00.tmp 2624 1B3E.tmp 2504 1B7C.tmp 2892 1BBB.tmp 2128 1C09.tmp 2632 1C38.tmp 1032 1C76.tmp 1816 1CB4.tmp 2172 1D22.tmp 344 1D50.tmp 2412 1D8F.tmp 1896 1DBE.tmp 2512 1DFC.tmp 1612 1E3A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 1280 2868 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 28 PID 2868 wrote to memory of 1280 2868 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 28 PID 2868 wrote to memory of 1280 2868 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 28 PID 2868 wrote to memory of 1280 2868 2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe 28 PID 1280 wrote to memory of 2356 1280 6E4.tmp 29 PID 1280 wrote to memory of 2356 1280 6E4.tmp 29 PID 1280 wrote to memory of 2356 1280 6E4.tmp 29 PID 1280 wrote to memory of 2356 1280 6E4.tmp 29 PID 2356 wrote to memory of 1272 2356 760.tmp 30 PID 2356 wrote to memory of 1272 2356 760.tmp 30 PID 2356 wrote to memory of 1272 2356 760.tmp 30 PID 2356 wrote to memory of 1272 2356 760.tmp 30 PID 1272 wrote to memory of 2652 1272 7FC.tmp 31 PID 1272 wrote to memory of 2652 1272 7FC.tmp 31 PID 1272 wrote to memory of 2652 1272 7FC.tmp 31 PID 1272 wrote to memory of 2652 1272 7FC.tmp 31 PID 2652 wrote to memory of 2816 2652 879.tmp 32 PID 2652 wrote to memory of 2816 2652 879.tmp 32 PID 2652 wrote to memory of 2816 2652 879.tmp 32 PID 2652 wrote to memory of 2816 2652 879.tmp 32 PID 2816 wrote to memory of 2732 2816 8D7.tmp 33 PID 2816 wrote to memory of 2732 2816 8D7.tmp 33 PID 2816 wrote to memory of 2732 2816 8D7.tmp 33 PID 2816 wrote to memory of 2732 2816 8D7.tmp 33 PID 2732 wrote to memory of 2764 2732 954.tmp 34 PID 2732 wrote to memory of 2764 2732 954.tmp 34 PID 2732 wrote to memory of 2764 2732 954.tmp 34 PID 2732 wrote to memory of 2764 2732 954.tmp 34 PID 2764 wrote to memory of 300 2764 A0F.tmp 35 PID 2764 wrote to memory of 300 2764 A0F.tmp 35 PID 2764 wrote to memory of 300 2764 A0F.tmp 35 PID 2764 wrote to memory of 300 2764 A0F.tmp 35 PID 300 wrote to memory of 2528 300 ABA.tmp 36 PID 300 wrote to memory of 2528 300 ABA.tmp 36 PID 300 wrote to memory of 2528 300 ABA.tmp 36 PID 300 wrote to memory of 2528 300 ABA.tmp 36 PID 2528 wrote to memory of 2520 2528 B85.tmp 37 PID 2528 wrote to memory of 2520 2528 B85.tmp 37 PID 2528 wrote to memory of 2520 2528 B85.tmp 37 PID 2528 wrote to memory of 2520 2528 B85.tmp 37 PID 2520 wrote to memory of 2340 2520 BF2.tmp 38 PID 2520 wrote to memory of 2340 2520 BF2.tmp 38 PID 2520 wrote to memory of 2340 2520 BF2.tmp 38 PID 2520 wrote to memory of 2340 2520 BF2.tmp 38 PID 2340 wrote to memory of 2860 2340 C50.tmp 39 PID 2340 wrote to memory of 2860 2340 C50.tmp 39 PID 2340 wrote to memory of 2860 2340 C50.tmp 39 PID 2340 wrote to memory of 2860 2340 C50.tmp 39 PID 2860 wrote to memory of 2172 2860 CAE.tmp 40 PID 2860 wrote to memory of 2172 2860 CAE.tmp 40 PID 2860 wrote to memory of 2172 2860 CAE.tmp 40 PID 2860 wrote to memory of 2172 2860 CAE.tmp 40 PID 2172 wrote to memory of 1888 2172 D3A.tmp 41 PID 2172 wrote to memory of 1888 2172 D3A.tmp 41 PID 2172 wrote to memory of 1888 2172 D3A.tmp 41 PID 2172 wrote to memory of 1888 2172 D3A.tmp 41 PID 1888 wrote to memory of 1896 1888 DE6.tmp 42 PID 1888 wrote to memory of 1896 1888 DE6.tmp 42 PID 1888 wrote to memory of 1896 1888 DE6.tmp 42 PID 1888 wrote to memory of 1896 1888 DE6.tmp 42 PID 1896 wrote to memory of 1660 1896 E24.tmp 43 PID 1896 wrote to memory of 1660 1896 E24.tmp 43 PID 1896 wrote to memory of 1660 1896 E24.tmp 43 PID 1896 wrote to memory of 1660 1896 E24.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_67662be4c708150e64a5eb2477800db4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\760.tmp"C:\Users\Admin\AppData\Local\Temp\760.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"65⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"66⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"67⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"68⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"70⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"71⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"72⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"73⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"74⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"75⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"76⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"77⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"78⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"79⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"80⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"81⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"82⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"83⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"84⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"85⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"86⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"87⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"88⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"89⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"90⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"91⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"92⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"93⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"94⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"95⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"96⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"97⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"98⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"99⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"100⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"101⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"102⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"103⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"104⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"105⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"106⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"107⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"108⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"109⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"110⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"111⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"112⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"113⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"114⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"116⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"118⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"119⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"120⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"121⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"122⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-