Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 04:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe
-
Size
536KB
-
MD5
c6ab5e7a8934e7b7204fd3d81fc7f033
-
SHA1
f8512408e6b6d6e3050c83b7d64df70c6bac183d
-
SHA256
fa0762cbe0d64a70df3b3a9d04374331705cba363b4350151bfd8b140f920b6f
-
SHA512
f90c5547a16895c06f7b8d53bd1af9323a40730bac430f5f21a149254b5660cb430cc9eb7fc2e4cd15a91070ca0c3dd0cec54f36897ce5ba025654fe04db710c
-
SSDEEP
12288:wU5rCOTeiU3sTlCOzlMHI9O2vLOsTmsVMIZxVJ0ZT9:wUQOJU3sThxdjBTmeMIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2936 17B5.tmp 2808 1813.tmp 2584 1851.tmp 2740 18CE.tmp 2748 190C.tmp 2480 194B.tmp 2712 1989.tmp 2464 19C8.tmp 2952 1A35.tmp 1952 1AB2.tmp 2772 1B00.tmp 3040 1B5D.tmp 2304 1BAB.tmp 820 1C18.tmp 2420 1CC4.tmp 376 1D22.tmp 2620 1D60.tmp 1432 1D9E.tmp 2320 1DEC.tmp 2292 1E3A.tmp 2164 1E88.tmp 1060 1EF6.tmp 808 1F44.tmp 1388 1F82.tmp 1100 1FC0.tmp 1868 204D.tmp 1320 209B.tmp 2964 20E9.tmp 796 2185.tmp 1688 21E2.tmp 1632 2221.tmp 1804 227E.tmp 1236 22BD.tmp 2056 230B.tmp 2108 2349.tmp 2072 2397.tmp 2372 23C6.tmp 1248 2404.tmp 1588 2443.tmp 1728 24A0.tmp 2872 24DF.tmp 2936 251D.tmp 2204 255C.tmp 2584 25AA.tmp 2824 2607.tmp 1984 2646.tmp 2480 2684.tmp 2908 26E2.tmp 2560 273F.tmp 2952 279D.tmp 2776 27DB.tmp 2772 2848.tmp 1672 2887.tmp 2612 28C5.tmp 2444 2904.tmp 2468 2961.tmp 632 29BF.tmp 2504 2A1C.tmp 2620 2A5B.tmp 1936 2A99.tmp 2168 2AD8.tmp 540 2B16.tmp 324 2B54.tmp 808 2B93.tmp -
Loads dropped DLL 64 IoCs
pid Process 2868 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 2936 17B5.tmp 2808 1813.tmp 2584 1851.tmp 2740 18CE.tmp 2748 190C.tmp 2480 194B.tmp 2712 1989.tmp 2464 19C8.tmp 2952 1A35.tmp 1952 1AB2.tmp 2772 1B00.tmp 3040 1B5D.tmp 2304 1BAB.tmp 820 1C18.tmp 2420 1CC4.tmp 376 1D22.tmp 2620 1D60.tmp 1432 1D9E.tmp 2320 1DEC.tmp 2292 1E3A.tmp 2164 1E88.tmp 1060 1EF6.tmp 808 1F44.tmp 1388 1F82.tmp 1100 1FC0.tmp 1868 204D.tmp 1320 209B.tmp 2964 20E9.tmp 796 2185.tmp 1688 21E2.tmp 1632 2221.tmp 1804 227E.tmp 1236 22BD.tmp 2056 230B.tmp 2108 2349.tmp 2072 2397.tmp 2372 23C6.tmp 1248 2404.tmp 1588 2443.tmp 1728 24A0.tmp 2872 24DF.tmp 2936 251D.tmp 2204 255C.tmp 2584 25AA.tmp 2824 2607.tmp 1984 2646.tmp 2480 2684.tmp 2908 26E2.tmp 2560 273F.tmp 2952 279D.tmp 2776 27DB.tmp 2772 2848.tmp 1672 2887.tmp 2612 28C5.tmp 2444 2904.tmp 2468 2961.tmp 632 29BF.tmp 2504 2A1C.tmp 2620 2A5B.tmp 1936 2A99.tmp 2168 2AD8.tmp 540 2B16.tmp 324 2B54.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2936 2868 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 28 PID 2868 wrote to memory of 2936 2868 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 28 PID 2868 wrote to memory of 2936 2868 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 69 PID 2868 wrote to memory of 2936 2868 2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe 69 PID 2936 wrote to memory of 2808 2936 17B5.tmp 29 PID 2936 wrote to memory of 2808 2936 17B5.tmp 29 PID 2936 wrote to memory of 2808 2936 17B5.tmp 29 PID 2936 wrote to memory of 2808 2936 17B5.tmp 29 PID 2808 wrote to memory of 2584 2808 1813.tmp 30 PID 2808 wrote to memory of 2584 2808 1813.tmp 30 PID 2808 wrote to memory of 2584 2808 1813.tmp 30 PID 2808 wrote to memory of 2584 2808 1813.tmp 30 PID 2584 wrote to memory of 2740 2584 1851.tmp 31 PID 2584 wrote to memory of 2740 2584 1851.tmp 31 PID 2584 wrote to memory of 2740 2584 1851.tmp 31 PID 2584 wrote to memory of 2740 2584 1851.tmp 31 PID 2740 wrote to memory of 2748 2740 18CE.tmp 32 PID 2740 wrote to memory of 2748 2740 18CE.tmp 32 PID 2740 wrote to memory of 2748 2740 18CE.tmp 32 PID 2740 wrote to memory of 2748 2740 18CE.tmp 32 PID 2748 wrote to memory of 2480 2748 190C.tmp 33 PID 2748 wrote to memory of 2480 2748 190C.tmp 33 PID 2748 wrote to memory of 2480 2748 190C.tmp 33 PID 2748 wrote to memory of 2480 2748 190C.tmp 33 PID 2480 wrote to memory of 2712 2480 194B.tmp 34 PID 2480 wrote to memory of 2712 2480 194B.tmp 34 PID 2480 wrote to memory of 2712 2480 194B.tmp 34 PID 2480 wrote to memory of 2712 2480 194B.tmp 34 PID 2712 wrote to memory of 2464 2712 1989.tmp 35 PID 2712 wrote to memory of 2464 2712 1989.tmp 35 PID 2712 wrote to memory of 2464 2712 1989.tmp 35 PID 2712 wrote to memory of 2464 2712 1989.tmp 35 PID 2464 wrote to memory of 2952 2464 19C8.tmp 36 PID 2464 wrote to memory of 2952 2464 19C8.tmp 36 PID 2464 wrote to memory of 2952 2464 19C8.tmp 36 PID 2464 wrote to memory of 2952 2464 19C8.tmp 36 PID 2952 wrote to memory of 1952 2952 1A35.tmp 37 PID 2952 wrote to memory of 1952 2952 1A35.tmp 37 PID 2952 wrote to memory of 1952 2952 1A35.tmp 37 PID 2952 wrote to memory of 1952 2952 1A35.tmp 37 PID 1952 wrote to memory of 2772 1952 1AB2.tmp 38 PID 1952 wrote to memory of 2772 1952 1AB2.tmp 38 PID 1952 wrote to memory of 2772 1952 1AB2.tmp 38 PID 1952 wrote to memory of 2772 1952 1AB2.tmp 38 PID 2772 wrote to memory of 3040 2772 1B00.tmp 39 PID 2772 wrote to memory of 3040 2772 1B00.tmp 39 PID 2772 wrote to memory of 3040 2772 1B00.tmp 39 PID 2772 wrote to memory of 3040 2772 1B00.tmp 39 PID 3040 wrote to memory of 2304 3040 1B5D.tmp 40 PID 3040 wrote to memory of 2304 3040 1B5D.tmp 40 PID 3040 wrote to memory of 2304 3040 1B5D.tmp 40 PID 3040 wrote to memory of 2304 3040 1B5D.tmp 40 PID 2304 wrote to memory of 820 2304 1BAB.tmp 41 PID 2304 wrote to memory of 820 2304 1BAB.tmp 41 PID 2304 wrote to memory of 820 2304 1BAB.tmp 41 PID 2304 wrote to memory of 820 2304 1BAB.tmp 41 PID 820 wrote to memory of 2420 820 1C18.tmp 42 PID 820 wrote to memory of 2420 820 1C18.tmp 42 PID 820 wrote to memory of 2420 820 1C18.tmp 42 PID 820 wrote to memory of 2420 820 1C18.tmp 42 PID 2420 wrote to memory of 376 2420 1CC4.tmp 43 PID 2420 wrote to memory of 376 2420 1CC4.tmp 43 PID 2420 wrote to memory of 376 2420 1CC4.tmp 43 PID 2420 wrote to memory of 376 2420 1CC4.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_c6ab5e7a8934e7b7204fd3d81fc7f033_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"65⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"66⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"67⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"68⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"69⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"70⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"71⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"72⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"73⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"74⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"75⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"76⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"78⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"79⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"80⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"81⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"82⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"83⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"84⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"85⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"86⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"87⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"88⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"89⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"90⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"91⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"92⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"93⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"94⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"95⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"96⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"97⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"99⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"100⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"101⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"102⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"103⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"104⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"105⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"106⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"107⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"108⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"109⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"110⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"111⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"112⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"113⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"114⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"115⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"116⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"117⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"118⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"119⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"120⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"121⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"122⤵PID:1332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-