Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe
-
Size
529KB
-
MD5
fa44ab025783d35c8d614476b73fd459
-
SHA1
122e34b075c46f205455853ecb5a7315ba56b728
-
SHA256
6585cccc5397eb83628293efbe3c76cf76cf48b32c7131434ac366fe982dd4ad
-
SHA512
0e35f26845bb278e5333d99bb86045ebeed62a3c8e738bed24f939f65ca54a82484277576ef4a5a46353c12db0f8c4a7b3c5701042fca8e41e17f2ab029f2391
-
SSDEEP
12288:NU5rCOTeij2X9E2eqPJjXzLodvMSO9iTZwlH4Hp:NUQOJje9HeWJXUVMS+iTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3020 EEF.tmp 2128 F2D.tmp 1904 F6C.tmp 2604 FBA.tmp 2724 1008.tmp 2080 1056.tmp 3016 1094.tmp 2800 10D2.tmp 2620 1111.tmp 2452 114F.tmp 2528 11AD.tmp 2140 11EB.tmp 1992 122A.tmp 2792 1268.tmp 2932 12B6.tmp 1600 12F4.tmp 1360 1342.tmp 2340 1381.tmp 864 13CF.tmp 1704 141D.tmp 2704 145B.tmp 1052 149A.tmp 1648 14E8.tmp 1548 1526.tmp 2068 1584.tmp 872 15C2.tmp 2864 1600.tmp 2796 163F.tmp 2200 167D.tmp 1808 16BC.tmp 600 16FA.tmp 488 1738.tmp 1124 1777.tmp 588 17B5.tmp 1920 17F4.tmp 1800 1832.tmp 932 1870.tmp 412 18AF.tmp 1340 18ED.tmp 2020 192C.tmp 1608 196A.tmp 1536 19A8.tmp 1380 19E7.tmp 1932 1A25.tmp 2332 1A64.tmp 1684 1A92.tmp 592 1AC1.tmp 1744 1B00.tmp 2324 1B3E.tmp 836 1B7C.tmp 2960 1BBB.tmp 1720 1BF9.tmp 1532 1C28.tmp 1752 1C66.tmp 1740 1CA5.tmp 1148 1D22.tmp 1524 1D60.tmp 2136 1D9E.tmp 2564 1DDD.tmp 1304 1E0C.tmp 2612 1E4A.tmp 2560 1E88.tmp 2736 1EC7.tmp 2836 1F05.tmp -
Loads dropped DLL 64 IoCs
pid Process 1148 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 3020 EEF.tmp 2128 F2D.tmp 1904 F6C.tmp 2604 FBA.tmp 2724 1008.tmp 2080 1056.tmp 3016 1094.tmp 2800 10D2.tmp 2620 1111.tmp 2452 114F.tmp 2528 11AD.tmp 2140 11EB.tmp 1992 122A.tmp 2792 1268.tmp 2932 12B6.tmp 1600 12F4.tmp 1360 1342.tmp 2340 1381.tmp 864 13CF.tmp 1704 141D.tmp 2704 145B.tmp 1052 149A.tmp 1648 14E8.tmp 1548 1526.tmp 2068 1584.tmp 872 15C2.tmp 2864 1600.tmp 2796 163F.tmp 2200 167D.tmp 1808 16BC.tmp 600 16FA.tmp 488 1738.tmp 1124 1777.tmp 588 17B5.tmp 1920 17F4.tmp 1800 1832.tmp 932 1870.tmp 412 18AF.tmp 1340 18ED.tmp 2020 192C.tmp 1608 196A.tmp 1536 19A8.tmp 1380 19E7.tmp 1932 1A25.tmp 2332 1A64.tmp 1684 1A92.tmp 592 1AC1.tmp 1744 1B00.tmp 2324 1B3E.tmp 836 1B7C.tmp 2960 1BBB.tmp 1720 1BF9.tmp 1532 1C28.tmp 1752 1C66.tmp 1628 1CE3.tmp 1148 1D22.tmp 1524 1D60.tmp 2136 1D9E.tmp 2564 1DDD.tmp 1304 1E0C.tmp 2612 1E4A.tmp 2560 1E88.tmp 2736 1EC7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3020 1148 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 28 PID 1148 wrote to memory of 3020 1148 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 28 PID 1148 wrote to memory of 3020 1148 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 28 PID 1148 wrote to memory of 3020 1148 2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe 28 PID 3020 wrote to memory of 2128 3020 EEF.tmp 29 PID 3020 wrote to memory of 2128 3020 EEF.tmp 29 PID 3020 wrote to memory of 2128 3020 EEF.tmp 29 PID 3020 wrote to memory of 2128 3020 EEF.tmp 29 PID 2128 wrote to memory of 1904 2128 F2D.tmp 30 PID 2128 wrote to memory of 1904 2128 F2D.tmp 30 PID 2128 wrote to memory of 1904 2128 F2D.tmp 30 PID 2128 wrote to memory of 1904 2128 F2D.tmp 30 PID 1904 wrote to memory of 2604 1904 F6C.tmp 31 PID 1904 wrote to memory of 2604 1904 F6C.tmp 31 PID 1904 wrote to memory of 2604 1904 F6C.tmp 31 PID 1904 wrote to memory of 2604 1904 F6C.tmp 31 PID 2604 wrote to memory of 2724 2604 FBA.tmp 32 PID 2604 wrote to memory of 2724 2604 FBA.tmp 32 PID 2604 wrote to memory of 2724 2604 FBA.tmp 32 PID 2604 wrote to memory of 2724 2604 FBA.tmp 32 PID 2724 wrote to memory of 2080 2724 1008.tmp 33 PID 2724 wrote to memory of 2080 2724 1008.tmp 33 PID 2724 wrote to memory of 2080 2724 1008.tmp 33 PID 2724 wrote to memory of 2080 2724 1008.tmp 33 PID 2080 wrote to memory of 3016 2080 1056.tmp 159 PID 2080 wrote to memory of 3016 2080 1056.tmp 159 PID 2080 wrote to memory of 3016 2080 1056.tmp 159 PID 2080 wrote to memory of 3016 2080 1056.tmp 159 PID 3016 wrote to memory of 2800 3016 1094.tmp 35 PID 3016 wrote to memory of 2800 3016 1094.tmp 35 PID 3016 wrote to memory of 2800 3016 1094.tmp 35 PID 3016 wrote to memory of 2800 3016 1094.tmp 35 PID 2800 wrote to memory of 2620 2800 10D2.tmp 36 PID 2800 wrote to memory of 2620 2800 10D2.tmp 36 PID 2800 wrote to memory of 2620 2800 10D2.tmp 36 PID 2800 wrote to memory of 2620 2800 10D2.tmp 36 PID 2620 wrote to memory of 2452 2620 1111.tmp 164 PID 2620 wrote to memory of 2452 2620 1111.tmp 164 PID 2620 wrote to memory of 2452 2620 1111.tmp 164 PID 2620 wrote to memory of 2452 2620 1111.tmp 164 PID 2452 wrote to memory of 2528 2452 114F.tmp 38 PID 2452 wrote to memory of 2528 2452 114F.tmp 38 PID 2452 wrote to memory of 2528 2452 114F.tmp 38 PID 2452 wrote to memory of 2528 2452 114F.tmp 38 PID 2528 wrote to memory of 2140 2528 11AD.tmp 100 PID 2528 wrote to memory of 2140 2528 11AD.tmp 100 PID 2528 wrote to memory of 2140 2528 11AD.tmp 100 PID 2528 wrote to memory of 2140 2528 11AD.tmp 100 PID 2140 wrote to memory of 1992 2140 11EB.tmp 40 PID 2140 wrote to memory of 1992 2140 11EB.tmp 40 PID 2140 wrote to memory of 1992 2140 11EB.tmp 40 PID 2140 wrote to memory of 1992 2140 11EB.tmp 40 PID 1992 wrote to memory of 2792 1992 122A.tmp 169 PID 1992 wrote to memory of 2792 1992 122A.tmp 169 PID 1992 wrote to memory of 2792 1992 122A.tmp 169 PID 1992 wrote to memory of 2792 1992 122A.tmp 169 PID 2792 wrote to memory of 2932 2792 1268.tmp 104 PID 2792 wrote to memory of 2932 2792 1268.tmp 104 PID 2792 wrote to memory of 2932 2792 1268.tmp 104 PID 2792 wrote to memory of 2932 2792 1268.tmp 104 PID 2932 wrote to memory of 1600 2932 12B6.tmp 171 PID 2932 wrote to memory of 1600 2932 12B6.tmp 171 PID 2932 wrote to memory of 1600 2932 12B6.tmp 171 PID 2932 wrote to memory of 1600 2932 12B6.tmp 171
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_fa44ab025783d35c8d614476b73fd459_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"56⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"57⤵
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"66⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"68⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"69⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"71⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"72⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"73⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"74⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"75⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"76⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"77⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"78⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"79⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"80⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"81⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"82⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"83⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"84⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"85⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"86⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"87⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"89⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"90⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"91⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"92⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"93⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"94⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"95⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"96⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"97⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"98⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"99⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"100⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"101⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"102⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"103⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"104⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"105⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"106⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"107⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"108⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"109⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"110⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"111⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"112⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"113⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"114⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"115⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"116⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"117⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"118⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"119⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"120⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"121⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"122⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-