Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe
-
Size
765KB
-
MD5
87bdff3a138a49b832df1654d09f9a07
-
SHA1
0946eb283c02326b7d6ec04b67b1d93ea3470ede
-
SHA256
e1913772685f4d08d7edd4c3be3a9a7401a60099b14d1b97bd89c30810028cef
-
SHA512
290eda03bf8292a7b2d2f8e9c832e34a39475fb64fed6991215f8a7a41f44cd22c90add2767ea913aa495ed2a2c5ac21d519c3364530269188715afeb4c00375
-
SSDEEP
12288:ZU5rCOTeiDvXQ/uZK6Ck6Ohdpx3ZF5rn5rLOa54U5w5A:ZUQOJDvg2ZK0V73vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2752 696.tmp 1616 703.tmp 2100 751.tmp 3036 7BE.tmp 2676 7FC.tmp 2868 83B.tmp 2584 889.tmp 2736 8E6.tmp 2732 954.tmp 2468 992.tmp 2540 9FF.tmp 2968 A3E.tmp 2352 A7C.tmp 2988 ABA.tmp 1408 B08.tmp 1448 B47.tmp 1920 B85.tmp 2644 BC4.tmp 2924 C40.tmp 2948 C8E.tmp 1080 D0B.tmp 1528 D4A.tmp 1772 D88.tmp 1676 DC6.tmp 1240 E05.tmp 1284 E62.tmp 1976 EB0.tmp 320 EEF.tmp 2724 F5C.tmp 488 F9A.tmp 112 FC9.tmp 1576 1008.tmp 1708 1046.tmp 848 1084.tmp 832 10C3.tmp 2004 10F2.tmp 1824 1120.tmp 1148 115F.tmp 2176 119D.tmp 2144 11EB.tmp 1812 122A.tmp 1344 1268.tmp 2272 1297.tmp 616 12D5.tmp 1596 1304.tmp 2324 1342.tmp 2372 1381.tmp 2412 13BF.tmp 2232 13EE.tmp 2240 142C.tmp 2388 147A.tmp 1644 14B9.tmp 2916 14F7.tmp 1672 1536.tmp 2972 1574.tmp 1556 15B2.tmp 1584 15F1.tmp 2552 162F.tmp 1616 166E.tmp 2100 169C.tmp 2680 16DB.tmp 1508 1719.tmp 2676 1758.tmp 2348 1786.tmp -
Loads dropped DLL 64 IoCs
pid Process 2548 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 2752 696.tmp 1616 703.tmp 2100 751.tmp 3036 7BE.tmp 2676 7FC.tmp 2868 83B.tmp 2584 889.tmp 2736 8E6.tmp 2732 954.tmp 2468 992.tmp 2540 9FF.tmp 2968 A3E.tmp 2352 A7C.tmp 2988 ABA.tmp 1408 B08.tmp 1448 B47.tmp 1920 B85.tmp 2644 BC4.tmp 2924 C40.tmp 2948 C8E.tmp 1080 D0B.tmp 1528 D4A.tmp 1772 D88.tmp 1676 DC6.tmp 1240 E05.tmp 1284 E62.tmp 1976 EB0.tmp 320 EEF.tmp 2724 F5C.tmp 488 F9A.tmp 112 FC9.tmp 1576 1008.tmp 1708 1046.tmp 848 1084.tmp 832 10C3.tmp 2004 10F2.tmp 1824 1120.tmp 1148 115F.tmp 2176 119D.tmp 2144 11EB.tmp 1812 122A.tmp 1344 1268.tmp 2272 1297.tmp 616 12D5.tmp 1596 1304.tmp 2324 1342.tmp 2372 1381.tmp 2412 13BF.tmp 2232 13EE.tmp 2240 142C.tmp 2388 147A.tmp 1644 14B9.tmp 2916 14F7.tmp 1672 1536.tmp 2972 1574.tmp 1556 15B2.tmp 1584 15F1.tmp 2552 162F.tmp 1616 166E.tmp 2100 169C.tmp 2680 16DB.tmp 1508 1719.tmp 2676 1758.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2752 2548 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 28 PID 2548 wrote to memory of 2752 2548 2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe 28 PID 2752 wrote to memory of 1616 2752 696.tmp 86 PID 2752 wrote to memory of 1616 2752 696.tmp 86 PID 2752 wrote to memory of 1616 2752 696.tmp 86 PID 2752 wrote to memory of 1616 2752 696.tmp 86 PID 1616 wrote to memory of 2100 1616 703.tmp 87 PID 1616 wrote to memory of 2100 1616 703.tmp 87 PID 1616 wrote to memory of 2100 1616 703.tmp 87 PID 1616 wrote to memory of 2100 1616 703.tmp 87 PID 2100 wrote to memory of 3036 2100 751.tmp 31 PID 2100 wrote to memory of 3036 2100 751.tmp 31 PID 2100 wrote to memory of 3036 2100 751.tmp 31 PID 2100 wrote to memory of 3036 2100 751.tmp 31 PID 3036 wrote to memory of 2676 3036 7BE.tmp 32 PID 3036 wrote to memory of 2676 3036 7BE.tmp 32 PID 3036 wrote to memory of 2676 3036 7BE.tmp 32 PID 3036 wrote to memory of 2676 3036 7BE.tmp 32 PID 2676 wrote to memory of 2868 2676 7FC.tmp 33 PID 2676 wrote to memory of 2868 2676 7FC.tmp 33 PID 2676 wrote to memory of 2868 2676 7FC.tmp 33 PID 2676 wrote to memory of 2868 2676 7FC.tmp 33 PID 2868 wrote to memory of 2584 2868 83B.tmp 34 PID 2868 wrote to memory of 2584 2868 83B.tmp 34 PID 2868 wrote to memory of 2584 2868 83B.tmp 34 PID 2868 wrote to memory of 2584 2868 83B.tmp 34 PID 2584 wrote to memory of 2736 2584 889.tmp 94 PID 2584 wrote to memory of 2736 2584 889.tmp 94 PID 2584 wrote to memory of 2736 2584 889.tmp 94 PID 2584 wrote to memory of 2736 2584 889.tmp 94 PID 2736 wrote to memory of 2732 2736 8E6.tmp 36 PID 2736 wrote to memory of 2732 2736 8E6.tmp 36 PID 2736 wrote to memory of 2732 2736 8E6.tmp 36 PID 2736 wrote to memory of 2732 2736 8E6.tmp 36 PID 2732 wrote to memory of 2468 2732 954.tmp 37 PID 2732 wrote to memory of 2468 2732 954.tmp 37 PID 2732 wrote to memory of 2468 2732 954.tmp 37 PID 2732 wrote to memory of 2468 2732 954.tmp 37 PID 2468 wrote to memory of 2540 2468 992.tmp 38 PID 2468 wrote to memory of 2540 2468 992.tmp 38 PID 2468 wrote to memory of 2540 2468 992.tmp 38 PID 2468 wrote to memory of 2540 2468 992.tmp 38 PID 2540 wrote to memory of 2968 2540 9FF.tmp 39 PID 2540 wrote to memory of 2968 2540 9FF.tmp 39 PID 2540 wrote to memory of 2968 2540 9FF.tmp 39 PID 2540 wrote to memory of 2968 2540 9FF.tmp 39 PID 2968 wrote to memory of 2352 2968 A3E.tmp 40 PID 2968 wrote to memory of 2352 2968 A3E.tmp 40 PID 2968 wrote to memory of 2352 2968 A3E.tmp 40 PID 2968 wrote to memory of 2352 2968 A3E.tmp 40 PID 2352 wrote to memory of 2988 2352 A7C.tmp 41 PID 2352 wrote to memory of 2988 2352 A7C.tmp 41 PID 2352 wrote to memory of 2988 2352 A7C.tmp 41 PID 2352 wrote to memory of 2988 2352 A7C.tmp 41 PID 2988 wrote to memory of 1408 2988 ABA.tmp 42 PID 2988 wrote to memory of 1408 2988 ABA.tmp 42 PID 2988 wrote to memory of 1408 2988 ABA.tmp 42 PID 2988 wrote to memory of 1408 2988 ABA.tmp 42 PID 1408 wrote to memory of 1448 1408 B08.tmp 43 PID 1408 wrote to memory of 1448 1408 B08.tmp 43 PID 1408 wrote to memory of 1448 1408 B08.tmp 43 PID 1408 wrote to memory of 1448 1408 B08.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_87bdff3a138a49b832df1654d09f9a07_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7FC.tmp"C:\Users\Admin\AppData\Local\Temp\7FC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\83B.tmp"C:\Users\Admin\AppData\Local\Temp\83B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"65⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"66⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"67⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"68⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"69⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"70⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"72⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"74⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"75⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"76⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"77⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"78⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"79⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"80⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"81⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"82⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"83⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"84⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"85⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"86⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"87⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"88⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"89⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"90⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"91⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"92⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"93⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"94⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"95⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"96⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"97⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"98⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"99⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"100⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"101⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"102⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"103⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"104⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"105⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"106⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"107⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"108⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"109⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"110⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"111⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"112⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"113⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"114⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"115⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"116⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"117⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"118⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"119⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"120⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"121⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-