Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
21/04/2024, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe
-
Size
486KB
-
MD5
bccff4e29b641f45aa2060d5c15678f6
-
SHA1
3d834a9138bb08379766daa45e633479b6519f10
-
SHA256
cd282413f3f017e1a8f404df0d88ef03c8e5fdcf64721b9a48fc8f90f295a5b0
-
SHA512
340fda8bda8e4bea57f56743d635a1b31de0ffdffd514da606f3b1c7f71ce0c6611de3826493ae56af3a7558745b7c3daa51e87ac495b6ff9d16139711c23d84
-
SSDEEP
12288:/U5rCOTeiDkBJeyxdIWBzNpOW3kPC59yEuHggcn:/UQOJDQJe6NBzNUPC59ycgcn
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2096 147A.tmp 852 14C8.tmp 1116 1545.tmp 1728 15A3.tmp 2600 1610.tmp 2692 166E.tmp 2744 16CB.tmp 2604 1729.tmp 2464 1796.tmp 2504 17F4.tmp 2472 1851.tmp 2496 18AF.tmp 3064 190C.tmp 952 196A.tmp 1904 19D7.tmp 1944 1A44.tmp 1548 1AA2.tmp 2044 1B00.tmp 2416 1B6D.tmp 2428 1BDA.tmp 2216 1C38.tmp 868 1C95.tmp 2936 1CD4.tmp 2808 1D22.tmp 2152 1D60.tmp 2296 1D9E.tmp 2084 1DDD.tmp 1312 1E1B.tmp 540 1E5A.tmp 324 1E98.tmp 888 1ED6.tmp 1456 1F24.tmp 856 1F63.tmp 800 1FB1.tmp 2176 1FEF.tmp 452 202E.tmp 3000 206C.tmp 2724 20AA.tmp 1148 20E9.tmp 860 2127.tmp 1564 2175.tmp 2288 21B4.tmp 764 21F2.tmp 788 2240.tmp 1076 227E.tmp 3048 22BD.tmp 2236 22FB.tmp 1964 233A.tmp 3040 2378.tmp 1520 23B6.tmp 2976 23F5.tmp 896 2433.tmp 1668 2472.tmp 2940 24B0.tmp 1600 24EE.tmp 1584 252D.tmp 2008 257B.tmp 1056 25B9.tmp 1992 25F8.tmp 1472 2636.tmp 2584 2674.tmp 2536 26B3.tmp 2688 2701.tmp 2728 273F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2004 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 2096 147A.tmp 852 14C8.tmp 1116 1545.tmp 1728 15A3.tmp 2600 1610.tmp 2692 166E.tmp 2744 16CB.tmp 2604 1729.tmp 2464 1796.tmp 2504 17F4.tmp 2472 1851.tmp 2496 18AF.tmp 3064 190C.tmp 952 196A.tmp 1904 19D7.tmp 1944 1A44.tmp 1548 1AA2.tmp 2044 1B00.tmp 2416 1B6D.tmp 2428 1BDA.tmp 2216 1C38.tmp 868 1C95.tmp 2936 1CD4.tmp 2808 1D22.tmp 2152 1D60.tmp 2296 1D9E.tmp 2084 1DDD.tmp 1312 1E1B.tmp 540 1E5A.tmp 324 1E98.tmp 888 1ED6.tmp 1456 1F24.tmp 856 1F63.tmp 800 1FB1.tmp 2176 1FEF.tmp 452 202E.tmp 3000 206C.tmp 2724 20AA.tmp 1148 20E9.tmp 860 2127.tmp 1564 2175.tmp 2288 21B4.tmp 764 21F2.tmp 788 2240.tmp 1076 227E.tmp 3048 22BD.tmp 2236 22FB.tmp 1964 233A.tmp 3040 2378.tmp 1520 23B6.tmp 2976 23F5.tmp 896 2433.tmp 1668 2472.tmp 2940 24B0.tmp 1600 24EE.tmp 1584 252D.tmp 2008 257B.tmp 1056 25B9.tmp 1992 25F8.tmp 1472 2636.tmp 2584 2674.tmp 2536 26B3.tmp 2688 2701.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2096 2004 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 28 PID 2004 wrote to memory of 2096 2004 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 28 PID 2004 wrote to memory of 2096 2004 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 28 PID 2004 wrote to memory of 2096 2004 2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe 28 PID 2096 wrote to memory of 852 2096 147A.tmp 29 PID 2096 wrote to memory of 852 2096 147A.tmp 29 PID 2096 wrote to memory of 852 2096 147A.tmp 29 PID 2096 wrote to memory of 852 2096 147A.tmp 29 PID 852 wrote to memory of 1116 852 14C8.tmp 30 PID 852 wrote to memory of 1116 852 14C8.tmp 30 PID 852 wrote to memory of 1116 852 14C8.tmp 30 PID 852 wrote to memory of 1116 852 14C8.tmp 30 PID 1116 wrote to memory of 1728 1116 1545.tmp 31 PID 1116 wrote to memory of 1728 1116 1545.tmp 31 PID 1116 wrote to memory of 1728 1116 1545.tmp 31 PID 1116 wrote to memory of 1728 1116 1545.tmp 31 PID 1728 wrote to memory of 2600 1728 15A3.tmp 32 PID 1728 wrote to memory of 2600 1728 15A3.tmp 32 PID 1728 wrote to memory of 2600 1728 15A3.tmp 32 PID 1728 wrote to memory of 2600 1728 15A3.tmp 32 PID 2600 wrote to memory of 2692 2600 1610.tmp 33 PID 2600 wrote to memory of 2692 2600 1610.tmp 33 PID 2600 wrote to memory of 2692 2600 1610.tmp 33 PID 2600 wrote to memory of 2692 2600 1610.tmp 33 PID 2692 wrote to memory of 2744 2692 166E.tmp 34 PID 2692 wrote to memory of 2744 2692 166E.tmp 34 PID 2692 wrote to memory of 2744 2692 166E.tmp 34 PID 2692 wrote to memory of 2744 2692 166E.tmp 34 PID 2744 wrote to memory of 2604 2744 16CB.tmp 35 PID 2744 wrote to memory of 2604 2744 16CB.tmp 35 PID 2744 wrote to memory of 2604 2744 16CB.tmp 35 PID 2744 wrote to memory of 2604 2744 16CB.tmp 35 PID 2604 wrote to memory of 2464 2604 1729.tmp 36 PID 2604 wrote to memory of 2464 2604 1729.tmp 36 PID 2604 wrote to memory of 2464 2604 1729.tmp 36 PID 2604 wrote to memory of 2464 2604 1729.tmp 36 PID 2464 wrote to memory of 2504 2464 1796.tmp 37 PID 2464 wrote to memory of 2504 2464 1796.tmp 37 PID 2464 wrote to memory of 2504 2464 1796.tmp 37 PID 2464 wrote to memory of 2504 2464 1796.tmp 37 PID 2504 wrote to memory of 2472 2504 17F4.tmp 38 PID 2504 wrote to memory of 2472 2504 17F4.tmp 38 PID 2504 wrote to memory of 2472 2504 17F4.tmp 38 PID 2504 wrote to memory of 2472 2504 17F4.tmp 38 PID 2472 wrote to memory of 2496 2472 1851.tmp 39 PID 2472 wrote to memory of 2496 2472 1851.tmp 39 PID 2472 wrote to memory of 2496 2472 1851.tmp 39 PID 2472 wrote to memory of 2496 2472 1851.tmp 39 PID 2496 wrote to memory of 3064 2496 18AF.tmp 40 PID 2496 wrote to memory of 3064 2496 18AF.tmp 40 PID 2496 wrote to memory of 3064 2496 18AF.tmp 40 PID 2496 wrote to memory of 3064 2496 18AF.tmp 40 PID 3064 wrote to memory of 952 3064 190C.tmp 41 PID 3064 wrote to memory of 952 3064 190C.tmp 41 PID 3064 wrote to memory of 952 3064 190C.tmp 41 PID 3064 wrote to memory of 952 3064 190C.tmp 41 PID 952 wrote to memory of 1904 952 196A.tmp 42 PID 952 wrote to memory of 1904 952 196A.tmp 42 PID 952 wrote to memory of 1904 952 196A.tmp 42 PID 952 wrote to memory of 1904 952 196A.tmp 42 PID 1904 wrote to memory of 1944 1904 19D7.tmp 43 PID 1904 wrote to memory of 1944 1904 19D7.tmp 43 PID 1904 wrote to memory of 1944 1904 19D7.tmp 43 PID 1904 wrote to memory of 1944 1904 19D7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_bccff4e29b641f45aa2060d5c15678f6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"65⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"66⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"67⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"69⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"70⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"71⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"72⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"73⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"74⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"75⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"76⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"77⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"78⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"79⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"80⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"81⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"82⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"83⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"84⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"85⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"86⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"87⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"88⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"89⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"90⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"91⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"92⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"93⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"94⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"95⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"96⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"99⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"100⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"101⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"102⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"103⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"104⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"105⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"106⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"107⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"108⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"109⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"110⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"111⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"112⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"113⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"114⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"115⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"116⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"117⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"118⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"119⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"120⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"121⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"122⤵PID:1632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-