Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe
-
Size
527KB
-
MD5
565b676638011797460f5bcb33b9fa85
-
SHA1
50bfdafe8bfd857c4b66b7f28783c49cfb022ea1
-
SHA256
0999370f58413a15da9d907896355aa3ee68cd622174d9d1baec5b5f3d1ef0f0
-
SHA512
3f71d1d8930ca385baf9b4fa5f0a13b2af81225cc6f22a2941ada9c49e8b3ba2e8c11098aa7f664fd846867940c3f7f4d4553603d22c759983d0d3dc87cf5caa
-
SSDEEP
12288:fU5rCOTeid/q+ApsGBNFgdBDBT+YcumDZu:fUQOJd/q+ApsGZitB6lDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2972 C50.tmp 3064 CAE.tmp 2200 D2A.tmp 2592 D88.tmp 2708 DF5.tmp 2596 E62.tmp 2580 ED0.tmp 2756 F3D.tmp 2576 F9A.tmp 2480 1008.tmp 1736 1075.tmp 2876 10E2.tmp 1756 114F.tmp 2188 11BC.tmp 1604 122A.tmp 352 1287.tmp 1032 12E5.tmp 1864 1342.tmp 2388 13B0.tmp 1972 13FE.tmp 1824 145B.tmp 2244 14C8.tmp 1548 1516.tmp 840 1564.tmp 2080 15A3.tmp 2172 15E1.tmp 1952 162F.tmp 2812 166E.tmp 1760 16AC.tmp 1172 16FA.tmp 324 1748.tmp 776 1786.tmp 1272 17C5.tmp 944 1803.tmp 1836 1851.tmp 1876 1890.tmp 2436 18CE.tmp 452 190C.tmp 2408 195A.tmp 544 1999.tmp 3056 19E7.tmp 1788 1A35.tmp 1388 1A73.tmp 2124 1AB2.tmp 1076 1AF0.tmp 912 1B3E.tmp 1748 1B8C.tmp 1048 1BCA.tmp 2256 1C09.tmp 1680 1C57.tmp 1812 1C95.tmp 2104 1CD4.tmp 1524 1D12.tmp 2228 1D50.tmp 2192 1D8F.tmp 1592 1DCD.tmp 2964 1E0C.tmp 2980 1E5A.tmp 2652 1E98.tmp 2960 1ED6.tmp 3024 1F24.tmp 2200 1F63.tmp 2800 1FB1.tmp 2616 1FFF.tmp -
Loads dropped DLL 64 IoCs
pid Process 2940 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 2972 C50.tmp 3064 CAE.tmp 2200 D2A.tmp 2592 D88.tmp 2708 DF5.tmp 2596 E62.tmp 2580 ED0.tmp 2756 F3D.tmp 2576 F9A.tmp 2480 1008.tmp 1736 1075.tmp 2876 10E2.tmp 1756 114F.tmp 2188 11BC.tmp 1604 122A.tmp 352 1287.tmp 1032 12E5.tmp 1864 1342.tmp 2388 13B0.tmp 1972 13FE.tmp 1824 145B.tmp 2244 14C8.tmp 1548 1516.tmp 840 1564.tmp 2080 15A3.tmp 2172 15E1.tmp 1952 162F.tmp 2812 166E.tmp 1760 16AC.tmp 1172 16FA.tmp 324 1748.tmp 776 1786.tmp 1272 17C5.tmp 944 1803.tmp 1836 1851.tmp 1876 1890.tmp 2436 18CE.tmp 452 190C.tmp 2408 195A.tmp 544 1999.tmp 3056 19E7.tmp 1788 1A35.tmp 1388 1A73.tmp 2124 1AB2.tmp 1076 1AF0.tmp 912 1B3E.tmp 1748 1B8C.tmp 1048 1BCA.tmp 2256 1C09.tmp 1680 1C57.tmp 1812 1C95.tmp 2104 1CD4.tmp 1524 1D12.tmp 2228 1D50.tmp 2192 1D8F.tmp 1592 1DCD.tmp 2964 1E0C.tmp 2980 1E5A.tmp 2652 1E98.tmp 2960 1ED6.tmp 3024 1F24.tmp 2200 1F63.tmp 2800 1FB1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2972 2940 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 28 PID 2940 wrote to memory of 2972 2940 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 28 PID 2940 wrote to memory of 2972 2940 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 28 PID 2940 wrote to memory of 2972 2940 2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe 28 PID 2972 wrote to memory of 3064 2972 C50.tmp 29 PID 2972 wrote to memory of 3064 2972 C50.tmp 29 PID 2972 wrote to memory of 3064 2972 C50.tmp 29 PID 2972 wrote to memory of 3064 2972 C50.tmp 29 PID 3064 wrote to memory of 2200 3064 CAE.tmp 30 PID 3064 wrote to memory of 2200 3064 CAE.tmp 30 PID 3064 wrote to memory of 2200 3064 CAE.tmp 30 PID 3064 wrote to memory of 2200 3064 CAE.tmp 30 PID 2200 wrote to memory of 2592 2200 D2A.tmp 31 PID 2200 wrote to memory of 2592 2200 D2A.tmp 31 PID 2200 wrote to memory of 2592 2200 D2A.tmp 31 PID 2200 wrote to memory of 2592 2200 D2A.tmp 31 PID 2592 wrote to memory of 2708 2592 D88.tmp 32 PID 2592 wrote to memory of 2708 2592 D88.tmp 32 PID 2592 wrote to memory of 2708 2592 D88.tmp 32 PID 2592 wrote to memory of 2708 2592 D88.tmp 32 PID 2708 wrote to memory of 2596 2708 DF5.tmp 33 PID 2708 wrote to memory of 2596 2708 DF5.tmp 33 PID 2708 wrote to memory of 2596 2708 DF5.tmp 33 PID 2708 wrote to memory of 2596 2708 DF5.tmp 33 PID 2596 wrote to memory of 2580 2596 E62.tmp 34 PID 2596 wrote to memory of 2580 2596 E62.tmp 34 PID 2596 wrote to memory of 2580 2596 E62.tmp 34 PID 2596 wrote to memory of 2580 2596 E62.tmp 34 PID 2580 wrote to memory of 2756 2580 ED0.tmp 35 PID 2580 wrote to memory of 2756 2580 ED0.tmp 35 PID 2580 wrote to memory of 2756 2580 ED0.tmp 35 PID 2580 wrote to memory of 2756 2580 ED0.tmp 35 PID 2756 wrote to memory of 2576 2756 F3D.tmp 36 PID 2756 wrote to memory of 2576 2756 F3D.tmp 36 PID 2756 wrote to memory of 2576 2756 F3D.tmp 36 PID 2756 wrote to memory of 2576 2756 F3D.tmp 36 PID 2576 wrote to memory of 2480 2576 F9A.tmp 37 PID 2576 wrote to memory of 2480 2576 F9A.tmp 37 PID 2576 wrote to memory of 2480 2576 F9A.tmp 37 PID 2576 wrote to memory of 2480 2576 F9A.tmp 37 PID 2480 wrote to memory of 1736 2480 1008.tmp 38 PID 2480 wrote to memory of 1736 2480 1008.tmp 38 PID 2480 wrote to memory of 1736 2480 1008.tmp 38 PID 2480 wrote to memory of 1736 2480 1008.tmp 38 PID 1736 wrote to memory of 2876 1736 1075.tmp 39 PID 1736 wrote to memory of 2876 1736 1075.tmp 39 PID 1736 wrote to memory of 2876 1736 1075.tmp 39 PID 1736 wrote to memory of 2876 1736 1075.tmp 39 PID 2876 wrote to memory of 1756 2876 10E2.tmp 40 PID 2876 wrote to memory of 1756 2876 10E2.tmp 40 PID 2876 wrote to memory of 1756 2876 10E2.tmp 40 PID 2876 wrote to memory of 1756 2876 10E2.tmp 40 PID 1756 wrote to memory of 2188 1756 114F.tmp 41 PID 1756 wrote to memory of 2188 1756 114F.tmp 41 PID 1756 wrote to memory of 2188 1756 114F.tmp 41 PID 1756 wrote to memory of 2188 1756 114F.tmp 41 PID 2188 wrote to memory of 1604 2188 11BC.tmp 42 PID 2188 wrote to memory of 1604 2188 11BC.tmp 42 PID 2188 wrote to memory of 1604 2188 11BC.tmp 42 PID 2188 wrote to memory of 1604 2188 11BC.tmp 42 PID 1604 wrote to memory of 352 1604 122A.tmp 43 PID 1604 wrote to memory of 352 1604 122A.tmp 43 PID 1604 wrote to memory of 352 1604 122A.tmp 43 PID 1604 wrote to memory of 352 1604 122A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_565b676638011797460f5bcb33b9fa85_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\145B.tmp"C:\Users\Admin\AppData\Local\Temp\145B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"66⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"67⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"68⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"69⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"70⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"71⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"72⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"73⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"74⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"75⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"76⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"77⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"78⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"79⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"80⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"81⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"82⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"83⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"84⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"86⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"87⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"88⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"89⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"90⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"91⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"92⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"93⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"94⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"96⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"97⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"98⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"99⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"100⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"101⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"102⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"103⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"104⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"105⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"106⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"107⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"108⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"109⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"110⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"111⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"112⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"113⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"114⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"115⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"116⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"117⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"119⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"120⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"121⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"122⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-