Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe
-
Size
765KB
-
MD5
b4c64e68c7c98b1ee9ca8410a457735e
-
SHA1
5e9fc3573a70eb661d03a80d8e4aff54f5b7af16
-
SHA256
8c9e264416d3e83971ac82347d7533436ac769f281f55d9232778715f273d882
-
SHA512
6b2b71704690372b035eafa93100c21281f189663aff322f5ca1275d917e25aa28908c3fdfefc183b173ca16984d12ddab99049406bd4b03c95da2556576f0b1
-
SSDEEP
12288:ZU5rCOTeiDZFlfLsL11ZXp5t3ZF5rn5rLOa54U5w5A:ZUQOJDZLILN/t3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2972 6A5.tmp 3060 712.tmp 1508 79F.tmp 2416 81C.tmp 2672 889.tmp 2668 8F6.tmp 2592 963.tmp 2816 9D0.tmp 2288 A5D.tmp 2640 ABA.tmp 2524 B37.tmp 2960 B95.tmp 1496 C12.tmp 2780 C6F.tmp 2280 CEC.tmp 1448 D69.tmp 1920 DE6.tmp 2644 E62.tmp 2924 EB0.tmp 2948 EFE.tmp 1080 F6C.tmp 1528 FD9.tmp 1772 1046.tmp 1676 1084.tmp 1240 10C3.tmp 1284 1101.tmp 1976 1140.tmp 320 117E.tmp 2724 11BC.tmp 488 120A.tmp 1168 1249.tmp 1624 1287.tmp 592 12C6.tmp 1872 1304.tmp 784 1342.tmp 1796 1381.tmp 452 13BF.tmp 1144 13FE.tmp 2164 143C.tmp 1372 147A.tmp 1532 14C8.tmp 1368 1507.tmp 1036 1545.tmp 1884 1584.tmp 912 15D2.tmp 1988 1610.tmp 1632 164E.tmp 2220 169C.tmp 108 16DB.tmp 3028 1719.tmp 2032 1758.tmp 1644 17A6.tmp 892 17E4.tmp 1028 1822.tmp 1984 1861.tmp 2028 18FD.tmp 3020 193B.tmp 2856 197A.tmp 3060 19D7.tmp 2292 1A16.tmp 2664 1A64.tmp 2596 1AA2.tmp 2872 1AE0.tmp 3052 1B1F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2024 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 2972 6A5.tmp 3060 712.tmp 1508 79F.tmp 2416 81C.tmp 2672 889.tmp 2668 8F6.tmp 2592 963.tmp 2816 9D0.tmp 2288 A5D.tmp 2640 ABA.tmp 2524 B37.tmp 2960 B95.tmp 1496 C12.tmp 2780 C6F.tmp 2280 CEC.tmp 1448 D69.tmp 1920 DE6.tmp 2644 E62.tmp 2924 EB0.tmp 2948 EFE.tmp 1080 F6C.tmp 1528 FD9.tmp 1772 1046.tmp 1676 1084.tmp 1240 10C3.tmp 1284 1101.tmp 1976 1140.tmp 320 117E.tmp 2724 11BC.tmp 488 120A.tmp 1168 1249.tmp 1624 1287.tmp 592 12C6.tmp 1872 1304.tmp 784 1342.tmp 1796 1381.tmp 452 13BF.tmp 1144 13FE.tmp 2164 143C.tmp 1372 147A.tmp 1532 14C8.tmp 1368 1507.tmp 1036 1545.tmp 1884 1584.tmp 912 15D2.tmp 1988 1610.tmp 1632 164E.tmp 2220 169C.tmp 108 16DB.tmp 3028 1719.tmp 2032 1758.tmp 1644 17A6.tmp 892 17E4.tmp 1028 1822.tmp 1592 189F.tmp 2028 18FD.tmp 3020 193B.tmp 2856 197A.tmp 3060 19D7.tmp 2292 1A16.tmp 2664 1A64.tmp 2596 1AA2.tmp 2872 1AE0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 2972 2024 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 28 PID 2024 wrote to memory of 2972 2024 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 28 PID 2024 wrote to memory of 2972 2024 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 28 PID 2024 wrote to memory of 2972 2024 2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe 28 PID 2972 wrote to memory of 3060 2972 6A5.tmp 29 PID 2972 wrote to memory of 3060 2972 6A5.tmp 29 PID 2972 wrote to memory of 3060 2972 6A5.tmp 29 PID 2972 wrote to memory of 3060 2972 6A5.tmp 29 PID 3060 wrote to memory of 1508 3060 712.tmp 30 PID 3060 wrote to memory of 1508 3060 712.tmp 30 PID 3060 wrote to memory of 1508 3060 712.tmp 30 PID 3060 wrote to memory of 1508 3060 712.tmp 30 PID 1508 wrote to memory of 2416 1508 79F.tmp 31 PID 1508 wrote to memory of 2416 1508 79F.tmp 31 PID 1508 wrote to memory of 2416 1508 79F.tmp 31 PID 1508 wrote to memory of 2416 1508 79F.tmp 31 PID 2416 wrote to memory of 2672 2416 81C.tmp 32 PID 2416 wrote to memory of 2672 2416 81C.tmp 32 PID 2416 wrote to memory of 2672 2416 81C.tmp 32 PID 2416 wrote to memory of 2672 2416 81C.tmp 32 PID 2672 wrote to memory of 2668 2672 889.tmp 33 PID 2672 wrote to memory of 2668 2672 889.tmp 33 PID 2672 wrote to memory of 2668 2672 889.tmp 33 PID 2672 wrote to memory of 2668 2672 889.tmp 33 PID 2668 wrote to memory of 2592 2668 8F6.tmp 34 PID 2668 wrote to memory of 2592 2668 8F6.tmp 34 PID 2668 wrote to memory of 2592 2668 8F6.tmp 34 PID 2668 wrote to memory of 2592 2668 8F6.tmp 34 PID 2592 wrote to memory of 2816 2592 963.tmp 35 PID 2592 wrote to memory of 2816 2592 963.tmp 35 PID 2592 wrote to memory of 2816 2592 963.tmp 35 PID 2592 wrote to memory of 2816 2592 963.tmp 35 PID 2816 wrote to memory of 2288 2816 9D0.tmp 36 PID 2816 wrote to memory of 2288 2816 9D0.tmp 36 PID 2816 wrote to memory of 2288 2816 9D0.tmp 36 PID 2816 wrote to memory of 2288 2816 9D0.tmp 36 PID 2288 wrote to memory of 2640 2288 A5D.tmp 37 PID 2288 wrote to memory of 2640 2288 A5D.tmp 37 PID 2288 wrote to memory of 2640 2288 A5D.tmp 37 PID 2288 wrote to memory of 2640 2288 A5D.tmp 37 PID 2640 wrote to memory of 2524 2640 ABA.tmp 38 PID 2640 wrote to memory of 2524 2640 ABA.tmp 38 PID 2640 wrote to memory of 2524 2640 ABA.tmp 38 PID 2640 wrote to memory of 2524 2640 ABA.tmp 38 PID 2524 wrote to memory of 2960 2524 B37.tmp 39 PID 2524 wrote to memory of 2960 2524 B37.tmp 39 PID 2524 wrote to memory of 2960 2524 B37.tmp 39 PID 2524 wrote to memory of 2960 2524 B37.tmp 39 PID 2960 wrote to memory of 1496 2960 B95.tmp 40 PID 2960 wrote to memory of 1496 2960 B95.tmp 40 PID 2960 wrote to memory of 1496 2960 B95.tmp 40 PID 2960 wrote to memory of 1496 2960 B95.tmp 40 PID 1496 wrote to memory of 2780 1496 C12.tmp 41 PID 1496 wrote to memory of 2780 1496 C12.tmp 41 PID 1496 wrote to memory of 2780 1496 C12.tmp 41 PID 1496 wrote to memory of 2780 1496 C12.tmp 41 PID 2780 wrote to memory of 2280 2780 C6F.tmp 42 PID 2780 wrote to memory of 2280 2780 C6F.tmp 42 PID 2780 wrote to memory of 2280 2780 C6F.tmp 42 PID 2780 wrote to memory of 2280 2780 C6F.tmp 42 PID 2280 wrote to memory of 1448 2280 CEC.tmp 43 PID 2280 wrote to memory of 1448 2280 CEC.tmp 43 PID 2280 wrote to memory of 1448 2280 CEC.tmp 43 PID 2280 wrote to memory of 1448 2280 CEC.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_b4c64e68c7c98b1ee9ca8410a457735e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9D0.tmp"C:\Users\Admin\AppData\Local\Temp\9D0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\ABA.tmp"C:\Users\Admin\AppData\Local\Temp\ABA.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\B37.tmp"C:\Users\Admin\AppData\Local\Temp\B37.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"56⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"57⤵
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"66⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"68⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"70⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"71⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"72⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"73⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"74⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"75⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"76⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"77⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"78⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"79⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"80⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"81⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"82⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"83⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"84⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"85⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"86⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"87⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"88⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"89⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"90⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"91⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"92⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"93⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"94⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"95⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"96⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"97⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"98⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"99⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"100⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"103⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"104⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"105⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"106⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"107⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"108⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"109⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"110⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"111⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"112⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"113⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"114⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"115⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"116⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"117⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"118⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"119⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"120⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"121⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-