Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe
-
Size
486KB
-
MD5
cd033af0435fe597f68cf7c49ebabb5d
-
SHA1
cbc570c97e9c5dee4e3975b1cdb6f412ff64cd2c
-
SHA256
8bbeda6c3b6087e008ccc837a0f7dc2eeac545e3a7a6c482bd72723bdddbcedd
-
SHA512
51c645bf18126fe40a706d877e355c793f85c6f54d218323a55d39117384ecb8838f376f9f86d84382099da4a18763d6c6aefd515f62928462dbde802dde78f0
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfDJSDhLPdyltO6U+5GAh6ZYYdRZ2vs8+WbTd2hU:/U5rCOTeiD8FPQl4+5xOZSvMJli6
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2588 12C6.tmp 3068 1333.tmp 2564 13B0.tmp 2524 140D.tmp 2828 148A.tmp 2900 14D8.tmp 2508 1545.tmp 2544 15A3.tmp 2420 1620.tmp 2908 167D.tmp 2124 16EA.tmp 2660 1758.tmp 2656 17C5.tmp 2764 1822.tmp 1608 1880.tmp 2028 18DE.tmp 2040 194B.tmp 2280 19C8.tmp 2092 1A25.tmp 2348 1AA2.tmp 1228 1B0F.tmp 1712 1B7C.tmp 2412 1BDA.tmp 2628 1C18.tmp 1968 1C66.tmp 2184 1CB4.tmp 2352 1CF3.tmp 1472 1D31.tmp 2860 1D7F.tmp 488 1DCD.tmp 992 1E0C.tmp 1416 1E5A.tmp 1400 1EA8.tmp 572 1EF6.tmp 1128 1F34.tmp 912 1F72.tmp 3012 1FC0.tmp 2336 200E.tmp 1512 204D.tmp 344 209B.tmp 1256 20E9.tmp 1920 2137.tmp 1540 2185.tmp 1912 21C3.tmp 1596 2211.tmp 864 225F.tmp 1048 22AD.tmp 628 22FB.tmp 2148 233A.tmp 1412 2378.tmp 1548 23C6.tmp 1676 2414.tmp 892 2462.tmp 2932 24A0.tmp 2236 24DF.tmp 2100 252D.tmp 1532 256B.tmp 2464 25B9.tmp 2500 25F8.tmp 2480 2636.tmp 2560 2684.tmp 2832 26C2.tmp 2380 2710.tmp 2408 274F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2100 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 2588 12C6.tmp 3068 1333.tmp 2564 13B0.tmp 2524 140D.tmp 2828 148A.tmp 2900 14D8.tmp 2508 1545.tmp 2544 15A3.tmp 2420 1620.tmp 2908 167D.tmp 2124 16EA.tmp 2660 1758.tmp 2656 17C5.tmp 2764 1822.tmp 1608 1880.tmp 2028 18DE.tmp 2040 194B.tmp 2280 19C8.tmp 2092 1A25.tmp 2348 1AA2.tmp 1228 1B0F.tmp 1712 1B7C.tmp 2412 1BDA.tmp 2628 1C18.tmp 1968 1C66.tmp 2184 1CB4.tmp 2352 1CF3.tmp 1472 1D31.tmp 2860 1D7F.tmp 488 1DCD.tmp 992 1E0C.tmp 1416 1E5A.tmp 1400 1EA8.tmp 572 1EF6.tmp 1128 1F34.tmp 912 1F72.tmp 3012 1FC0.tmp 2336 200E.tmp 1512 204D.tmp 344 209B.tmp 1256 20E9.tmp 1920 2137.tmp 1540 2185.tmp 1912 21C3.tmp 1596 2211.tmp 864 225F.tmp 1048 22AD.tmp 628 22FB.tmp 2148 233A.tmp 1412 2378.tmp 1548 23C6.tmp 1676 2414.tmp 892 2462.tmp 2932 24A0.tmp 2236 24DF.tmp 2100 252D.tmp 1532 256B.tmp 2464 25B9.tmp 2500 25F8.tmp 2480 2636.tmp 2560 2684.tmp 2832 26C2.tmp 2380 2710.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2588 2100 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 28 PID 2100 wrote to memory of 2588 2100 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 28 PID 2100 wrote to memory of 2588 2100 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 28 PID 2100 wrote to memory of 2588 2100 2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe 28 PID 2588 wrote to memory of 3068 2588 12C6.tmp 29 PID 2588 wrote to memory of 3068 2588 12C6.tmp 29 PID 2588 wrote to memory of 3068 2588 12C6.tmp 29 PID 2588 wrote to memory of 3068 2588 12C6.tmp 29 PID 3068 wrote to memory of 2564 3068 1333.tmp 30 PID 3068 wrote to memory of 2564 3068 1333.tmp 30 PID 3068 wrote to memory of 2564 3068 1333.tmp 30 PID 3068 wrote to memory of 2564 3068 1333.tmp 30 PID 2564 wrote to memory of 2524 2564 13B0.tmp 31 PID 2564 wrote to memory of 2524 2564 13B0.tmp 31 PID 2564 wrote to memory of 2524 2564 13B0.tmp 31 PID 2564 wrote to memory of 2524 2564 13B0.tmp 31 PID 2524 wrote to memory of 2828 2524 140D.tmp 32 PID 2524 wrote to memory of 2828 2524 140D.tmp 32 PID 2524 wrote to memory of 2828 2524 140D.tmp 32 PID 2524 wrote to memory of 2828 2524 140D.tmp 32 PID 2828 wrote to memory of 2900 2828 148A.tmp 33 PID 2828 wrote to memory of 2900 2828 148A.tmp 33 PID 2828 wrote to memory of 2900 2828 148A.tmp 33 PID 2828 wrote to memory of 2900 2828 148A.tmp 33 PID 2900 wrote to memory of 2508 2900 14D8.tmp 34 PID 2900 wrote to memory of 2508 2900 14D8.tmp 34 PID 2900 wrote to memory of 2508 2900 14D8.tmp 34 PID 2900 wrote to memory of 2508 2900 14D8.tmp 34 PID 2508 wrote to memory of 2544 2508 1545.tmp 35 PID 2508 wrote to memory of 2544 2508 1545.tmp 35 PID 2508 wrote to memory of 2544 2508 1545.tmp 35 PID 2508 wrote to memory of 2544 2508 1545.tmp 35 PID 2544 wrote to memory of 2420 2544 15A3.tmp 36 PID 2544 wrote to memory of 2420 2544 15A3.tmp 36 PID 2544 wrote to memory of 2420 2544 15A3.tmp 36 PID 2544 wrote to memory of 2420 2544 15A3.tmp 36 PID 2420 wrote to memory of 2908 2420 1620.tmp 37 PID 2420 wrote to memory of 2908 2420 1620.tmp 37 PID 2420 wrote to memory of 2908 2420 1620.tmp 37 PID 2420 wrote to memory of 2908 2420 1620.tmp 37 PID 2908 wrote to memory of 2124 2908 167D.tmp 38 PID 2908 wrote to memory of 2124 2908 167D.tmp 38 PID 2908 wrote to memory of 2124 2908 167D.tmp 38 PID 2908 wrote to memory of 2124 2908 167D.tmp 38 PID 2124 wrote to memory of 2660 2124 16EA.tmp 39 PID 2124 wrote to memory of 2660 2124 16EA.tmp 39 PID 2124 wrote to memory of 2660 2124 16EA.tmp 39 PID 2124 wrote to memory of 2660 2124 16EA.tmp 39 PID 2660 wrote to memory of 2656 2660 1758.tmp 40 PID 2660 wrote to memory of 2656 2660 1758.tmp 40 PID 2660 wrote to memory of 2656 2660 1758.tmp 40 PID 2660 wrote to memory of 2656 2660 1758.tmp 40 PID 2656 wrote to memory of 2764 2656 17C5.tmp 41 PID 2656 wrote to memory of 2764 2656 17C5.tmp 41 PID 2656 wrote to memory of 2764 2656 17C5.tmp 41 PID 2656 wrote to memory of 2764 2656 17C5.tmp 41 PID 2764 wrote to memory of 1608 2764 1822.tmp 42 PID 2764 wrote to memory of 1608 2764 1822.tmp 42 PID 2764 wrote to memory of 1608 2764 1822.tmp 42 PID 2764 wrote to memory of 1608 2764 1822.tmp 42 PID 1608 wrote to memory of 2028 1608 1880.tmp 43 PID 1608 wrote to memory of 2028 1608 1880.tmp 43 PID 1608 wrote to memory of 2028 1608 1880.tmp 43 PID 1608 wrote to memory of 2028 1608 1880.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_cd033af0435fe597f68cf7c49ebabb5d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"65⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"66⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"68⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"69⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"70⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"71⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"72⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"73⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"74⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"75⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"76⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"77⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"78⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"79⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"80⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"81⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"82⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"83⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"84⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"85⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"86⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"87⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"88⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"89⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"90⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"91⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"92⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"93⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"94⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"95⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"96⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"97⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"98⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"99⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"100⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"101⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"103⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"104⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"105⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"106⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"107⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"108⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"109⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"110⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"111⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"112⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"113⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"114⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"115⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"116⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"117⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"118⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"119⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"120⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"121⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-