Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe
-
Size
541KB
-
MD5
1495a5b8a8d6bdf81fe369fa9a37d612
-
SHA1
2d860cca88de5f3e2a7a7ba3320649c0db112924
-
SHA256
28b0f4155eda5483c5fff519dc26f77a7b15186576310532277bbcea8cc68694
-
SHA512
69b52f4c1864f7f68aa97e3babcc0df5b052d6ee9c8a79ffe2cf0a32bfd555204a58da699ef852be798a2bafa486264becc11033c4f0486cde75b07ac17e15ad
-
SSDEEP
12288:UU5rCOTeifvLVSjowcxrU1fGxsQErZa73ctO:UUQOJfvLVmcO1FQErU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1744 1239.tmp 3052 1297.tmp 2548 1304.tmp 2604 1352.tmp 2680 13BF.tmp 2812 142C.tmp 2988 148A.tmp 2780 14E8.tmp 2620 1545.tmp 2452 15A3.tmp 2576 1610.tmp 2976 165E.tmp 1952 169C.tmp 2792 170A.tmp 2144 1767.tmp 1600 17D4.tmp 1656 1822.tmp 908 1880.tmp 1120 18ED.tmp 1700 195A.tmp 2516 19C8.tmp 1832 1A25.tmp 2272 1A73.tmp 1324 1AB2.tmp 2084 1AF0.tmp 2100 1B3E.tmp 2836 1B7C.tmp 2692 1BBB.tmp 2152 1BF9.tmp 2256 1C38.tmp 608 1C76.tmp 488 1CB4.tmp 1044 1CF3.tmp 1664 1D31.tmp 1812 1D70.tmp 924 1DAE.tmp 1660 1DEC.tmp 408 1E2B.tmp 1336 1E69.tmp 2972 1EA8.tmp 1376 1EE6.tmp 1048 1F34.tmp 832 1F72.tmp 2196 1FB1.tmp 1080 1FFF.tmp 956 203D.tmp 1288 207C.tmp 2008 20CA.tmp 1884 2108.tmp 2960 2146.tmp 1004 2185.tmp 912 21C3.tmp 1864 2202.tmp 2932 2240.tmp 1624 227E.tmp 2396 22BD.tmp 2116 22FB.tmp 2796 233A.tmp 2748 2378.tmp 2584 23B6.tmp 2596 23F5.tmp 2648 2433.tmp 2816 2481.tmp 2560 24C0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2032 2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe 1744 1239.tmp 3052 1297.tmp 2548 1304.tmp 2604 1352.tmp 2680 13BF.tmp 2812 142C.tmp 2988 148A.tmp 2780 14E8.tmp 2620 1545.tmp 2452 15A3.tmp 2576 1610.tmp 2976 165E.tmp 1952 169C.tmp 2792 170A.tmp 2144 1767.tmp 1600 17D4.tmp 1656 1822.tmp 908 1880.tmp 1120 18ED.tmp 1700 195A.tmp 2516 19C8.tmp 1832 1A25.tmp 2272 1A73.tmp 1324 1AB2.tmp 2084 1AF0.tmp 2100 1B3E.tmp 2836 1B7C.tmp 2692 1BBB.tmp 2152 1BF9.tmp 2256 1C38.tmp 608 1C76.tmp 488 1CB4.tmp 1044 1CF3.tmp 1664 1D31.tmp 1812 1D70.tmp 924 1DAE.tmp 1660 1DEC.tmp 408 1E2B.tmp 1336 1E69.tmp 2972 1EA8.tmp 1376 1EE6.tmp 1048 1F34.tmp 832 1F72.tmp 2196 1FB1.tmp 1080 1FFF.tmp 956 203D.tmp 1288 207C.tmp 2008 20CA.tmp 1884 2108.tmp 2960 2146.tmp 1004 2185.tmp 912 21C3.tmp 1864 2202.tmp 2932 2240.tmp 1624 227E.tmp 2396 22BD.tmp 2116 22FB.tmp 2796 233A.tmp 2748 2378.tmp 2584 23B6.tmp 2596 23F5.tmp 2648 2433.tmp 2816 2481.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1744 2032 2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe 28 PID 2032 wrote to memory of 1744 2032 2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe 28 PID 2032 wrote to memory of 1744 2032 2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe 28 PID 2032 wrote to memory of 1744 2032 2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe 28 PID 1744 wrote to memory of 3052 1744 1239.tmp 29 PID 1744 wrote to memory of 3052 1744 1239.tmp 29 PID 1744 wrote to memory of 3052 1744 1239.tmp 29 PID 1744 wrote to memory of 3052 1744 1239.tmp 29 PID 3052 wrote to memory of 2548 3052 1297.tmp 30 PID 3052 wrote to memory of 2548 3052 1297.tmp 30 PID 3052 wrote to memory of 2548 3052 1297.tmp 30 PID 3052 wrote to memory of 2548 3052 1297.tmp 30 PID 2548 wrote to memory of 2604 2548 1304.tmp 31 PID 2548 wrote to memory of 2604 2548 1304.tmp 31 PID 2548 wrote to memory of 2604 2548 1304.tmp 31 PID 2548 wrote to memory of 2604 2548 1304.tmp 31 PID 2604 wrote to memory of 2680 2604 1352.tmp 32 PID 2604 wrote to memory of 2680 2604 1352.tmp 32 PID 2604 wrote to memory of 2680 2604 1352.tmp 32 PID 2604 wrote to memory of 2680 2604 1352.tmp 32 PID 2680 wrote to memory of 2812 2680 13BF.tmp 33 PID 2680 wrote to memory of 2812 2680 13BF.tmp 33 PID 2680 wrote to memory of 2812 2680 13BF.tmp 33 PID 2680 wrote to memory of 2812 2680 13BF.tmp 33 PID 2812 wrote to memory of 2988 2812 142C.tmp 34 PID 2812 wrote to memory of 2988 2812 142C.tmp 34 PID 2812 wrote to memory of 2988 2812 142C.tmp 34 PID 2812 wrote to memory of 2988 2812 142C.tmp 34 PID 2988 wrote to memory of 2780 2988 148A.tmp 35 PID 2988 wrote to memory of 2780 2988 148A.tmp 35 PID 2988 wrote to memory of 2780 2988 148A.tmp 35 PID 2988 wrote to memory of 2780 2988 148A.tmp 35 PID 2780 wrote to memory of 2620 2780 14E8.tmp 36 PID 2780 wrote to memory of 2620 2780 14E8.tmp 36 PID 2780 wrote to memory of 2620 2780 14E8.tmp 36 PID 2780 wrote to memory of 2620 2780 14E8.tmp 36 PID 2620 wrote to memory of 2452 2620 1545.tmp 37 PID 2620 wrote to memory of 2452 2620 1545.tmp 37 PID 2620 wrote to memory of 2452 2620 1545.tmp 37 PID 2620 wrote to memory of 2452 2620 1545.tmp 37 PID 2452 wrote to memory of 2576 2452 15A3.tmp 38 PID 2452 wrote to memory of 2576 2452 15A3.tmp 38 PID 2452 wrote to memory of 2576 2452 15A3.tmp 38 PID 2452 wrote to memory of 2576 2452 15A3.tmp 38 PID 2576 wrote to memory of 2976 2576 1610.tmp 39 PID 2576 wrote to memory of 2976 2576 1610.tmp 39 PID 2576 wrote to memory of 2976 2576 1610.tmp 39 PID 2576 wrote to memory of 2976 2576 1610.tmp 39 PID 2976 wrote to memory of 1952 2976 165E.tmp 40 PID 2976 wrote to memory of 1952 2976 165E.tmp 40 PID 2976 wrote to memory of 1952 2976 165E.tmp 40 PID 2976 wrote to memory of 1952 2976 165E.tmp 40 PID 1952 wrote to memory of 2792 1952 169C.tmp 41 PID 1952 wrote to memory of 2792 1952 169C.tmp 41 PID 1952 wrote to memory of 2792 1952 169C.tmp 41 PID 1952 wrote to memory of 2792 1952 169C.tmp 41 PID 2792 wrote to memory of 2144 2792 170A.tmp 42 PID 2792 wrote to memory of 2144 2792 170A.tmp 42 PID 2792 wrote to memory of 2144 2792 170A.tmp 42 PID 2792 wrote to memory of 2144 2792 170A.tmp 42 PID 2144 wrote to memory of 1600 2144 1767.tmp 43 PID 2144 wrote to memory of 1600 2144 1767.tmp 43 PID 2144 wrote to memory of 1600 2144 1767.tmp 43 PID 2144 wrote to memory of 1600 2144 1767.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_1495a5b8a8d6bdf81fe369fa9a37d612_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"66⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"67⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"68⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"69⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"70⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"71⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"72⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"73⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"74⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"75⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"76⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"77⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"78⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"79⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"80⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"81⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"82⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"83⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"84⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"86⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"87⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"88⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"89⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"90⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"92⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"93⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"94⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"95⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"96⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"97⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"98⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"99⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"100⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"101⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"102⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"103⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"104⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"105⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"106⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"107⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"108⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"109⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"110⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"111⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"112⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"113⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"114⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"115⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"116⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"117⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"118⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"119⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"120⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"121⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"122⤵PID:2032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-