Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe
-
Size
529KB
-
MD5
e5e01e8c1bb6914bfa8eb2539461a3c5
-
SHA1
3816bfd9a9bc13a847be417733efe6695df2be62
-
SHA256
94078dfa2384f0e0633e94659849e9911486418f2c1ce23cf74059c2eb12f213
-
SHA512
0c6fbd21197e9ff517ec79856955d94d60d69d9715fbec2df1cee4173b94518aab5ee84bd66d14ccde60513ad828eb3eba9667ae88ecc226efd7ef3922eb0294
-
SSDEEP
12288:NU5rCOTeijhG4Jvfv7eUJsehKFCwOaIoETZwlH4Hp:NUQOJjE8nvnJsgKFOacTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 864 F5C.tmp 2464 FAA.tmp 2576 1027.tmp 2524 1084.tmp 2812 10E2.tmp 2692 1140.tmp 2396 119D.tmp 2664 11FB.tmp 2384 1268.tmp 2540 12C6.tmp 2900 1333.tmp 2440 1381.tmp 2620 13DE.tmp 2772 143C.tmp 2728 14A9.tmp 1908 1507.tmp 376 1564.tmp 1644 15C2.tmp 2260 162F.tmp 2360 169C.tmp 1572 170A.tmp 1556 1777.tmp 1708 17C5.tmp 2928 1803.tmp 2908 1842.tmp 1668 1890.tmp 2352 18CE.tmp 1860 190C.tmp 1276 194B.tmp 696 1989.tmp 1004 19D7.tmp 1420 1A25.tmp 2832 1A64.tmp 2752 1AB2.tmp 1376 1AF0.tmp 380 1B2E.tmp 1884 1B7C.tmp 412 1BBB.tmp 2072 1BF9.tmp 2960 1C38.tmp 1716 1C76.tmp 2000 1CB4.tmp 1812 1CF3.tmp 2184 1D31.tmp 1604 1D7F.tmp 1580 1DBE.tmp 2292 1DFC.tmp 3020 1E3A.tmp 1748 1E79.tmp 576 1EB7.tmp 3064 1EF6.tmp 1628 1F34.tmp 1440 1F72.tmp 1744 1FB1.tmp 2148 1FFF.tmp 1540 203D.tmp 2956 207C.tmp 2968 20BA.tmp 2916 20F8.tmp 2528 2137.tmp 2652 2175.tmp 2480 21B4.tmp 2964 21F2.tmp 2976 2240.tmp -
Loads dropped DLL 64 IoCs
pid Process 1636 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 864 F5C.tmp 2464 FAA.tmp 2576 1027.tmp 2524 1084.tmp 2812 10E2.tmp 2692 1140.tmp 2396 119D.tmp 2664 11FB.tmp 2384 1268.tmp 2540 12C6.tmp 2900 1333.tmp 2440 1381.tmp 2620 13DE.tmp 2772 143C.tmp 2728 14A9.tmp 1908 1507.tmp 376 1564.tmp 1644 15C2.tmp 2260 162F.tmp 2360 169C.tmp 1572 170A.tmp 1556 1777.tmp 1708 17C5.tmp 2928 1803.tmp 2908 1842.tmp 1668 1890.tmp 2352 18CE.tmp 1860 190C.tmp 1276 194B.tmp 696 1989.tmp 1004 19D7.tmp 1420 1A25.tmp 2832 1A64.tmp 2752 1AB2.tmp 1376 1AF0.tmp 380 1B2E.tmp 1884 1B7C.tmp 412 1BBB.tmp 2072 1BF9.tmp 2960 1C38.tmp 1716 1C76.tmp 2000 1CB4.tmp 1812 1CF3.tmp 2184 1D31.tmp 1604 1D7F.tmp 1580 1DBE.tmp 2292 1DFC.tmp 3020 1E3A.tmp 1748 1E79.tmp 576 1EB7.tmp 3064 1EF6.tmp 1628 1F34.tmp 1440 1F72.tmp 1744 1FB1.tmp 2148 1FFF.tmp 1540 203D.tmp 2956 207C.tmp 2968 20BA.tmp 2916 20F8.tmp 2528 2137.tmp 2652 2175.tmp 2480 21B4.tmp 2964 21F2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 864 1636 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 28 PID 1636 wrote to memory of 864 1636 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 28 PID 1636 wrote to memory of 864 1636 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 28 PID 1636 wrote to memory of 864 1636 2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe 28 PID 864 wrote to memory of 2464 864 F5C.tmp 29 PID 864 wrote to memory of 2464 864 F5C.tmp 29 PID 864 wrote to memory of 2464 864 F5C.tmp 29 PID 864 wrote to memory of 2464 864 F5C.tmp 29 PID 2464 wrote to memory of 2576 2464 FAA.tmp 30 PID 2464 wrote to memory of 2576 2464 FAA.tmp 30 PID 2464 wrote to memory of 2576 2464 FAA.tmp 30 PID 2464 wrote to memory of 2576 2464 FAA.tmp 30 PID 2576 wrote to memory of 2524 2576 1027.tmp 31 PID 2576 wrote to memory of 2524 2576 1027.tmp 31 PID 2576 wrote to memory of 2524 2576 1027.tmp 31 PID 2576 wrote to memory of 2524 2576 1027.tmp 31 PID 2524 wrote to memory of 2812 2524 1084.tmp 32 PID 2524 wrote to memory of 2812 2524 1084.tmp 32 PID 2524 wrote to memory of 2812 2524 1084.tmp 32 PID 2524 wrote to memory of 2812 2524 1084.tmp 32 PID 2812 wrote to memory of 2692 2812 10E2.tmp 33 PID 2812 wrote to memory of 2692 2812 10E2.tmp 33 PID 2812 wrote to memory of 2692 2812 10E2.tmp 33 PID 2812 wrote to memory of 2692 2812 10E2.tmp 33 PID 2692 wrote to memory of 2396 2692 1140.tmp 34 PID 2692 wrote to memory of 2396 2692 1140.tmp 34 PID 2692 wrote to memory of 2396 2692 1140.tmp 34 PID 2692 wrote to memory of 2396 2692 1140.tmp 34 PID 2396 wrote to memory of 2664 2396 119D.tmp 35 PID 2396 wrote to memory of 2664 2396 119D.tmp 35 PID 2396 wrote to memory of 2664 2396 119D.tmp 35 PID 2396 wrote to memory of 2664 2396 119D.tmp 35 PID 2664 wrote to memory of 2384 2664 11FB.tmp 36 PID 2664 wrote to memory of 2384 2664 11FB.tmp 36 PID 2664 wrote to memory of 2384 2664 11FB.tmp 36 PID 2664 wrote to memory of 2384 2664 11FB.tmp 36 PID 2384 wrote to memory of 2540 2384 1268.tmp 37 PID 2384 wrote to memory of 2540 2384 1268.tmp 37 PID 2384 wrote to memory of 2540 2384 1268.tmp 37 PID 2384 wrote to memory of 2540 2384 1268.tmp 37 PID 2540 wrote to memory of 2900 2540 12C6.tmp 38 PID 2540 wrote to memory of 2900 2540 12C6.tmp 38 PID 2540 wrote to memory of 2900 2540 12C6.tmp 38 PID 2540 wrote to memory of 2900 2540 12C6.tmp 38 PID 2900 wrote to memory of 2440 2900 1333.tmp 39 PID 2900 wrote to memory of 2440 2900 1333.tmp 39 PID 2900 wrote to memory of 2440 2900 1333.tmp 39 PID 2900 wrote to memory of 2440 2900 1333.tmp 39 PID 2440 wrote to memory of 2620 2440 1381.tmp 40 PID 2440 wrote to memory of 2620 2440 1381.tmp 40 PID 2440 wrote to memory of 2620 2440 1381.tmp 40 PID 2440 wrote to memory of 2620 2440 1381.tmp 40 PID 2620 wrote to memory of 2772 2620 13DE.tmp 41 PID 2620 wrote to memory of 2772 2620 13DE.tmp 41 PID 2620 wrote to memory of 2772 2620 13DE.tmp 41 PID 2620 wrote to memory of 2772 2620 13DE.tmp 41 PID 2772 wrote to memory of 2728 2772 143C.tmp 42 PID 2772 wrote to memory of 2728 2772 143C.tmp 42 PID 2772 wrote to memory of 2728 2772 143C.tmp 42 PID 2772 wrote to memory of 2728 2772 143C.tmp 42 PID 2728 wrote to memory of 1908 2728 14A9.tmp 43 PID 2728 wrote to memory of 1908 2728 14A9.tmp 43 PID 2728 wrote to memory of 1908 2728 14A9.tmp 43 PID 2728 wrote to memory of 1908 2728 14A9.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_e5e01e8c1bb6914bfa8eb2539461a3c5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\162F.tmp"C:\Users\Admin\AppData\Local\Temp\162F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"65⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"66⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"67⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"68⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"69⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"70⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"71⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"72⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"73⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"74⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"75⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"76⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"77⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"78⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"79⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"80⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"81⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"82⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"83⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"84⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"85⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"86⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"87⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"88⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"89⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"90⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"91⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"92⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"93⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"94⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"95⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"96⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"97⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"98⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"100⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"101⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"102⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"103⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"104⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"105⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"106⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"107⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"108⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"109⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"110⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"111⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"112⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"113⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"114⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"116⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"117⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"118⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"119⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"120⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"121⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-