Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/04/2024, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe
-
Size
486KB
-
MD5
aea79abbf1322d44a36e5620dbca9e61
-
SHA1
13ea4858ac10857bbfbf0529ca035463f83be7d9
-
SHA256
f383c32c3eca1206f0080757bcb009524ab7148fcb23cbb2659025ba57caca21
-
SHA512
bffa77f96f3cf180167927640f5c85980cc990e0f4113d37fb94ddf0927eb92f9ae1ab3004f455b4a5356a0b48108c0079c60e8fb7b2e0e5c6d25dcde6b22c7b
-
SSDEEP
12288:UU5rCOTeiDk157cEVR0JBoR44Of/ol6RXdMUNZ:UUQOJDk7rLOgQN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2052 1729.tmp 3000 1777.tmp 3056 17F4.tmp 3004 1851.tmp 2596 18AF.tmp 2716 191C.tmp 2700 196A.tmp 2872 19C8.tmp 2468 1A35.tmp 1672 1A92.tmp 2460 1B00.tmp 1524 1B5D.tmp 1252 1BBB.tmp 1908 1C18.tmp 2780 1C86.tmp 1676 1CF3.tmp 636 1D60.tmp 2248 1DCD.tmp 1196 1E2B.tmp 2800 1EA8.tmp 1540 1F05.tmp 1192 1F63.tmp 1060 1FC0.tmp 2296 1FFF.tmp 2948 203D.tmp 1900 207C.tmp 2000 20BA.tmp 1952 2108.tmp 1744 2146.tmp 596 2185.tmp 488 21C3.tmp 616 2202.tmp 584 2240.tmp 572 227E.tmp 1040 22BD.tmp 2036 22FB.tmp 2188 233A.tmp 1128 2378.tmp 2884 23B6.tmp 1476 23F5.tmp 1828 2433.tmp 928 2472.tmp 1972 24B0.tmp 960 24EE.tmp 904 252D.tmp 1332 257B.tmp 2868 25B9.tmp 1392 2607.tmp 2900 2646.tmp 2904 2684.tmp 1576 26D2.tmp 1164 2710.tmp 1608 274F.tmp 1892 278D.tmp 1588 27CC.tmp 1592 281A.tmp 2860 2858.tmp 3020 2896.tmp 1580 28D5.tmp 1728 2913.tmp 2152 2952.tmp 1944 2990.tmp 2672 29CE.tmp 2668 2A0D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2216 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 2052 1729.tmp 3000 1777.tmp 3056 17F4.tmp 3004 1851.tmp 2596 18AF.tmp 2716 191C.tmp 2700 196A.tmp 2872 19C8.tmp 2468 1A35.tmp 1672 1A92.tmp 2460 1B00.tmp 1524 1B5D.tmp 1252 1BBB.tmp 1908 1C18.tmp 2780 1C86.tmp 1676 1CF3.tmp 636 1D60.tmp 2248 1DCD.tmp 1196 1E2B.tmp 2800 1EA8.tmp 1540 1F05.tmp 1192 1F63.tmp 1060 1FC0.tmp 2296 1FFF.tmp 2948 203D.tmp 1900 207C.tmp 2000 20BA.tmp 1952 2108.tmp 1744 2146.tmp 596 2185.tmp 488 21C3.tmp 616 2202.tmp 584 2240.tmp 572 227E.tmp 1040 22BD.tmp 2036 22FB.tmp 2188 233A.tmp 1128 2378.tmp 2884 23B6.tmp 1476 23F5.tmp 1828 2433.tmp 928 2472.tmp 1972 24B0.tmp 960 24EE.tmp 904 252D.tmp 1332 257B.tmp 2868 25B9.tmp 1392 2607.tmp 2900 2646.tmp 2904 2684.tmp 1576 26D2.tmp 1164 2710.tmp 1608 274F.tmp 1892 278D.tmp 1588 27CC.tmp 1592 281A.tmp 2860 2858.tmp 3020 2896.tmp 1580 28D5.tmp 1728 2913.tmp 2152 2952.tmp 1944 2990.tmp 2672 29CE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2052 2216 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 28 PID 2216 wrote to memory of 2052 2216 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 28 PID 2216 wrote to memory of 2052 2216 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 28 PID 2216 wrote to memory of 2052 2216 2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe 28 PID 2052 wrote to memory of 3000 2052 1729.tmp 29 PID 2052 wrote to memory of 3000 2052 1729.tmp 29 PID 2052 wrote to memory of 3000 2052 1729.tmp 29 PID 2052 wrote to memory of 3000 2052 1729.tmp 29 PID 3000 wrote to memory of 3056 3000 1777.tmp 30 PID 3000 wrote to memory of 3056 3000 1777.tmp 30 PID 3000 wrote to memory of 3056 3000 1777.tmp 30 PID 3000 wrote to memory of 3056 3000 1777.tmp 30 PID 3056 wrote to memory of 3004 3056 17F4.tmp 31 PID 3056 wrote to memory of 3004 3056 17F4.tmp 31 PID 3056 wrote to memory of 3004 3056 17F4.tmp 31 PID 3056 wrote to memory of 3004 3056 17F4.tmp 31 PID 3004 wrote to memory of 2596 3004 1851.tmp 32 PID 3004 wrote to memory of 2596 3004 1851.tmp 32 PID 3004 wrote to memory of 2596 3004 1851.tmp 32 PID 3004 wrote to memory of 2596 3004 1851.tmp 32 PID 2596 wrote to memory of 2716 2596 18AF.tmp 33 PID 2596 wrote to memory of 2716 2596 18AF.tmp 33 PID 2596 wrote to memory of 2716 2596 18AF.tmp 33 PID 2596 wrote to memory of 2716 2596 18AF.tmp 33 PID 2716 wrote to memory of 2700 2716 191C.tmp 34 PID 2716 wrote to memory of 2700 2716 191C.tmp 34 PID 2716 wrote to memory of 2700 2716 191C.tmp 34 PID 2716 wrote to memory of 2700 2716 191C.tmp 34 PID 2700 wrote to memory of 2872 2700 196A.tmp 35 PID 2700 wrote to memory of 2872 2700 196A.tmp 35 PID 2700 wrote to memory of 2872 2700 196A.tmp 35 PID 2700 wrote to memory of 2872 2700 196A.tmp 35 PID 2872 wrote to memory of 2468 2872 19C8.tmp 36 PID 2872 wrote to memory of 2468 2872 19C8.tmp 36 PID 2872 wrote to memory of 2468 2872 19C8.tmp 36 PID 2872 wrote to memory of 2468 2872 19C8.tmp 36 PID 2468 wrote to memory of 1672 2468 1A35.tmp 37 PID 2468 wrote to memory of 1672 2468 1A35.tmp 37 PID 2468 wrote to memory of 1672 2468 1A35.tmp 37 PID 2468 wrote to memory of 1672 2468 1A35.tmp 37 PID 1672 wrote to memory of 2460 1672 1A92.tmp 38 PID 1672 wrote to memory of 2460 1672 1A92.tmp 38 PID 1672 wrote to memory of 2460 1672 1A92.tmp 38 PID 1672 wrote to memory of 2460 1672 1A92.tmp 38 PID 2460 wrote to memory of 1524 2460 1B00.tmp 39 PID 2460 wrote to memory of 1524 2460 1B00.tmp 39 PID 2460 wrote to memory of 1524 2460 1B00.tmp 39 PID 2460 wrote to memory of 1524 2460 1B00.tmp 39 PID 1524 wrote to memory of 1252 1524 1B5D.tmp 40 PID 1524 wrote to memory of 1252 1524 1B5D.tmp 40 PID 1524 wrote to memory of 1252 1524 1B5D.tmp 40 PID 1524 wrote to memory of 1252 1524 1B5D.tmp 40 PID 1252 wrote to memory of 1908 1252 1BBB.tmp 41 PID 1252 wrote to memory of 1908 1252 1BBB.tmp 41 PID 1252 wrote to memory of 1908 1252 1BBB.tmp 41 PID 1252 wrote to memory of 1908 1252 1BBB.tmp 41 PID 1908 wrote to memory of 2780 1908 1C18.tmp 42 PID 1908 wrote to memory of 2780 1908 1C18.tmp 42 PID 1908 wrote to memory of 2780 1908 1C18.tmp 42 PID 1908 wrote to memory of 2780 1908 1C18.tmp 42 PID 2780 wrote to memory of 1676 2780 1C86.tmp 43 PID 2780 wrote to memory of 1676 2780 1C86.tmp 43 PID 2780 wrote to memory of 1676 2780 1C86.tmp 43 PID 2780 wrote to memory of 1676 2780 1C86.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_aea79abbf1322d44a36e5620dbca9e61_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"65⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"66⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"67⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"68⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"69⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"70⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"71⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"72⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"73⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"74⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"75⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"76⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"77⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"78⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"79⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"80⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"81⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"82⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"83⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"84⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"85⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"86⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"87⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"88⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"89⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"90⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"91⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"92⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"93⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"94⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"95⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"96⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"97⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"98⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"99⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"100⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"102⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"103⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"104⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"105⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"106⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"107⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"108⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"109⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"110⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"111⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"112⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"113⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"114⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"115⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"116⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"117⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"118⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"119⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"120⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"121⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"122⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-