Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe
-
Size
486KB
-
MD5
8f89149d58279d9997df3433da58a010
-
SHA1
d25cba70d5321a6b8ea637d82b64bb96087fa6c3
-
SHA256
797144dfe592b2a15bddc73d36b8ae73c9a288b9577599e6eac33b5dbc419ac0
-
SHA512
0ae28f18387b4df301e16dbb3bffaefc96379d1d6c60321d6bc78a159c86334df1fe7260579f8e5d83acf12ac6dd002796519d2beaf5e3a07d272ed34cd915f4
-
SSDEEP
12288:UU5rCOTeiDhrttOjXfJ5bgCsS1qx+laN4qj3NZ:UUQOJDhnIfIZwdlm42N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1296 D98.tmp 1124 E05.tmp 2540 E72.tmp 2168 EC0.tmp 2564 F0E.tmp 2680 F4C.tmp 2080 F9A.tmp 2584 FF8.tmp 2768 1046.tmp 2056 1084.tmp 2476 10C3.tmp 2504 1130.tmp 3044 117E.tmp 1864 11DC.tmp 1824 121A.tmp 1664 1268.tmp 1984 12C6.tmp 2120 1304.tmp 876 1342.tmp 1480 1381.tmp 1524 13CF.tmp 1636 140D.tmp 1148 144C.tmp 2892 149A.tmp 2996 14D8.tmp 2292 1516.tmp 2252 1555.tmp 2268 1593.tmp 1964 15D2.tmp 488 1610.tmp 1168 164E.tmp 584 168D.tmp 1900 16CB.tmp 560 170A.tmp 2432 1738.tmp 1940 1777.tmp 1140 17B5.tmp 2764 17F4.tmp 3028 1822.tmp 1136 1861.tmp 1792 189F.tmp 984 18DE.tmp 1020 192C.tmp 1096 196A.tmp 1836 19B8.tmp 980 1A06.tmp 2140 1A64.tmp 3032 1AC1.tmp 2844 1B00.tmp 2156 1B3E.tmp 3040 1B7C.tmp 1760 1BBB.tmp 2856 1BF9.tmp 3000 1C38.tmp 1608 1C76.tmp 2364 1CB4.tmp 2312 1CF3.tmp 2400 1D31.tmp 1124 1D70.tmp 2644 1DAE.tmp 2588 1DEC.tmp 2568 1E3A.tmp 2564 1E79.tmp 2468 1EB7.tmp -
Loads dropped DLL 64 IoCs
pid Process 2364 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 1296 D98.tmp 1124 E05.tmp 2540 E72.tmp 2168 EC0.tmp 2564 F0E.tmp 2680 F4C.tmp 2080 F9A.tmp 2584 FF8.tmp 2768 1046.tmp 2056 1084.tmp 2476 10C3.tmp 2504 1130.tmp 3044 117E.tmp 1864 11DC.tmp 1824 121A.tmp 1664 1268.tmp 1984 12C6.tmp 2120 1304.tmp 876 1342.tmp 1480 1381.tmp 1524 13CF.tmp 1636 140D.tmp 1148 144C.tmp 2892 149A.tmp 2996 14D8.tmp 2292 1516.tmp 2252 1555.tmp 2268 1593.tmp 1964 15D2.tmp 488 1610.tmp 1168 164E.tmp 584 168D.tmp 1900 16CB.tmp 560 170A.tmp 2432 1738.tmp 1940 1777.tmp 1140 17B5.tmp 2764 17F4.tmp 3028 1822.tmp 1136 1861.tmp 1792 189F.tmp 984 18DE.tmp 1020 192C.tmp 1096 196A.tmp 1836 19B8.tmp 980 1A06.tmp 2140 1A64.tmp 3032 1AC1.tmp 2844 1B00.tmp 2156 1B3E.tmp 3040 1B7C.tmp 1760 1BBB.tmp 2856 1BF9.tmp 3000 1C38.tmp 1608 1C76.tmp 2364 1CB4.tmp 2312 1CF3.tmp 2400 1D31.tmp 1124 1D70.tmp 2644 1DAE.tmp 2588 1DEC.tmp 2568 1E3A.tmp 2564 1E79.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1296 2364 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 28 PID 2364 wrote to memory of 1296 2364 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 28 PID 2364 wrote to memory of 1296 2364 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 28 PID 2364 wrote to memory of 1296 2364 2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe 28 PID 1296 wrote to memory of 1124 1296 D98.tmp 29 PID 1296 wrote to memory of 1124 1296 D98.tmp 29 PID 1296 wrote to memory of 1124 1296 D98.tmp 29 PID 1296 wrote to memory of 1124 1296 D98.tmp 29 PID 1124 wrote to memory of 2540 1124 E05.tmp 30 PID 1124 wrote to memory of 2540 1124 E05.tmp 30 PID 1124 wrote to memory of 2540 1124 E05.tmp 30 PID 1124 wrote to memory of 2540 1124 E05.tmp 30 PID 2540 wrote to memory of 2168 2540 E72.tmp 31 PID 2540 wrote to memory of 2168 2540 E72.tmp 31 PID 2540 wrote to memory of 2168 2540 E72.tmp 31 PID 2540 wrote to memory of 2168 2540 E72.tmp 31 PID 2168 wrote to memory of 2564 2168 EC0.tmp 32 PID 2168 wrote to memory of 2564 2168 EC0.tmp 32 PID 2168 wrote to memory of 2564 2168 EC0.tmp 32 PID 2168 wrote to memory of 2564 2168 EC0.tmp 32 PID 2564 wrote to memory of 2680 2564 F0E.tmp 33 PID 2564 wrote to memory of 2680 2564 F0E.tmp 33 PID 2564 wrote to memory of 2680 2564 F0E.tmp 33 PID 2564 wrote to memory of 2680 2564 F0E.tmp 33 PID 2680 wrote to memory of 2080 2680 F4C.tmp 34 PID 2680 wrote to memory of 2080 2680 F4C.tmp 34 PID 2680 wrote to memory of 2080 2680 F4C.tmp 34 PID 2680 wrote to memory of 2080 2680 F4C.tmp 34 PID 2080 wrote to memory of 2584 2080 F9A.tmp 35 PID 2080 wrote to memory of 2584 2080 F9A.tmp 35 PID 2080 wrote to memory of 2584 2080 F9A.tmp 35 PID 2080 wrote to memory of 2584 2080 F9A.tmp 35 PID 2584 wrote to memory of 2768 2584 FF8.tmp 36 PID 2584 wrote to memory of 2768 2584 FF8.tmp 36 PID 2584 wrote to memory of 2768 2584 FF8.tmp 36 PID 2584 wrote to memory of 2768 2584 FF8.tmp 36 PID 2768 wrote to memory of 2056 2768 1046.tmp 37 PID 2768 wrote to memory of 2056 2768 1046.tmp 37 PID 2768 wrote to memory of 2056 2768 1046.tmp 37 PID 2768 wrote to memory of 2056 2768 1046.tmp 37 PID 2056 wrote to memory of 2476 2056 1084.tmp 38 PID 2056 wrote to memory of 2476 2056 1084.tmp 38 PID 2056 wrote to memory of 2476 2056 1084.tmp 38 PID 2056 wrote to memory of 2476 2056 1084.tmp 38 PID 2476 wrote to memory of 2504 2476 10C3.tmp 39 PID 2476 wrote to memory of 2504 2476 10C3.tmp 39 PID 2476 wrote to memory of 2504 2476 10C3.tmp 39 PID 2476 wrote to memory of 2504 2476 10C3.tmp 39 PID 2504 wrote to memory of 3044 2504 1130.tmp 40 PID 2504 wrote to memory of 3044 2504 1130.tmp 40 PID 2504 wrote to memory of 3044 2504 1130.tmp 40 PID 2504 wrote to memory of 3044 2504 1130.tmp 40 PID 3044 wrote to memory of 1864 3044 117E.tmp 41 PID 3044 wrote to memory of 1864 3044 117E.tmp 41 PID 3044 wrote to memory of 1864 3044 117E.tmp 41 PID 3044 wrote to memory of 1864 3044 117E.tmp 41 PID 1864 wrote to memory of 1824 1864 11DC.tmp 42 PID 1864 wrote to memory of 1824 1864 11DC.tmp 42 PID 1864 wrote to memory of 1824 1864 11DC.tmp 42 PID 1864 wrote to memory of 1824 1864 11DC.tmp 42 PID 1824 wrote to memory of 1664 1824 121A.tmp 43 PID 1824 wrote to memory of 1664 1824 121A.tmp 43 PID 1824 wrote to memory of 1664 1824 121A.tmp 43 PID 1824 wrote to memory of 1664 1824 121A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_8f89149d58279d9997df3433da58a010_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"65⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"66⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"67⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"68⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"69⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"70⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"71⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"72⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"74⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"75⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"76⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"77⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"78⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"79⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"80⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"81⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"82⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"83⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"84⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"85⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"86⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"87⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"88⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"89⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"90⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"92⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"93⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"94⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"95⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"96⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"97⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"99⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"100⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"101⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"102⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"103⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"104⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"105⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"106⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"107⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"108⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"109⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"110⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"111⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"113⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"114⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"115⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"116⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"117⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"119⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"120⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"121⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-