Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 04:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe
-
Size
527KB
-
MD5
51a56aaae321b64ad21f40a1c6aa3070
-
SHA1
260bf6803a3eebc281babc2431848cdbeacb23d5
-
SHA256
c41933764f78a375417e019c0ea2acc63753c6654df76b348433bf3ca1b77260
-
SHA512
a9589f5691bf34395b587c89c5884cbdd282aeaf7a50cd6b2dde7841c4a62649bb33985adb6208034b2655b5bbb5b089147ac05000c93d28416fc2568d2fd65f
-
SSDEEP
12288:fU5rCOTeidd5AQs1Palr92FBAoKv36O8xVAeiqDZu:fUQOJdnA3YlRGAtvKO8xVAoDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1656 C40.tmp 2472 CAE.tmp 2524 CEC.tmp 2616 D2A.tmp 2800 D98.tmp 2984 E14.tmp 2868 E72.tmp 2548 ED0.tmp 2380 F2D.tmp 2452 F9A.tmp 3056 FF8.tmp 1912 1056.tmp 2688 10B3.tmp 2704 1120.tmp 1872 117E.tmp 1856 11EB.tmp 2260 1258.tmp 1212 12B6.tmp 1568 1314.tmp 1364 1362.tmp 2272 13CF.tmp 1488 142C.tmp 1700 148A.tmp 3064 14C8.tmp 2172 1507.tmp 2236 1545.tmp 2360 1584.tmp 1900 15D2.tmp 2192 1620.tmp 612 165E.tmp 532 169C.tmp 1076 16DB.tmp 1416 1729.tmp 1732 1767.tmp 1120 17A6.tmp 1260 17E4.tmp 2944 1822.tmp 1016 1870.tmp 1200 18AF.tmp 1380 18ED.tmp 1632 193B.tmp 1524 197A.tmp 1560 19B8.tmp 1888 19F6.tmp 1728 1A35.tmp 1984 1A73.tmp 2916 1AC1.tmp 1608 1B00.tmp 1452 1B3E.tmp 1196 1B7C.tmp 656 1BBB.tmp 2112 1BF9.tmp 1692 1C38.tmp 2144 1C76.tmp 1840 1CB4.tmp 1660 1CF3.tmp 2240 1D31.tmp 2072 1D70.tmp 2488 1DBE.tmp 2952 1DFC.tmp 2524 1E3A.tmp 2504 1E79.tmp 2528 1EB7.tmp 2540 1EF6.tmp -
Loads dropped DLL 64 IoCs
pid Process 2240 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 1656 C40.tmp 2472 CAE.tmp 2524 CEC.tmp 2616 D2A.tmp 2800 D98.tmp 2984 E14.tmp 2868 E72.tmp 2548 ED0.tmp 2380 F2D.tmp 2452 F9A.tmp 3056 FF8.tmp 1912 1056.tmp 2688 10B3.tmp 2704 1120.tmp 1872 117E.tmp 1856 11EB.tmp 2260 1258.tmp 1212 12B6.tmp 1568 1314.tmp 1364 1362.tmp 2272 13CF.tmp 1488 142C.tmp 1700 148A.tmp 3064 14C8.tmp 2172 1507.tmp 2236 1545.tmp 2360 1584.tmp 1900 15D2.tmp 2192 1620.tmp 612 165E.tmp 532 169C.tmp 1076 16DB.tmp 1416 1729.tmp 1732 1767.tmp 1120 17A6.tmp 1260 17E4.tmp 2944 1822.tmp 1016 1870.tmp 1200 18AF.tmp 1380 18ED.tmp 1632 193B.tmp 1524 197A.tmp 1560 19B8.tmp 1888 19F6.tmp 1728 1A35.tmp 1984 1A73.tmp 2916 1AC1.tmp 1608 1B00.tmp 1452 1B3E.tmp 1196 1B7C.tmp 656 1BBB.tmp 2112 1BF9.tmp 1692 1C38.tmp 2144 1C76.tmp 1840 1CB4.tmp 1660 1CF3.tmp 2240 1D31.tmp 2072 1D70.tmp 2488 1DBE.tmp 2952 1DFC.tmp 2524 1E3A.tmp 2504 1E79.tmp 2528 1EB7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1656 2240 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 28 PID 2240 wrote to memory of 1656 2240 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 28 PID 2240 wrote to memory of 1656 2240 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 28 PID 2240 wrote to memory of 1656 2240 2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe 28 PID 1656 wrote to memory of 2472 1656 C40.tmp 29 PID 1656 wrote to memory of 2472 1656 C40.tmp 29 PID 1656 wrote to memory of 2472 1656 C40.tmp 29 PID 1656 wrote to memory of 2472 1656 C40.tmp 29 PID 2472 wrote to memory of 2524 2472 CAE.tmp 30 PID 2472 wrote to memory of 2524 2472 CAE.tmp 30 PID 2472 wrote to memory of 2524 2472 CAE.tmp 30 PID 2472 wrote to memory of 2524 2472 CAE.tmp 30 PID 2524 wrote to memory of 2616 2524 CEC.tmp 31 PID 2524 wrote to memory of 2616 2524 CEC.tmp 31 PID 2524 wrote to memory of 2616 2524 CEC.tmp 31 PID 2524 wrote to memory of 2616 2524 CEC.tmp 31 PID 2616 wrote to memory of 2800 2616 D2A.tmp 32 PID 2616 wrote to memory of 2800 2616 D2A.tmp 32 PID 2616 wrote to memory of 2800 2616 D2A.tmp 32 PID 2616 wrote to memory of 2800 2616 D2A.tmp 32 PID 2800 wrote to memory of 2984 2800 D98.tmp 33 PID 2800 wrote to memory of 2984 2800 D98.tmp 33 PID 2800 wrote to memory of 2984 2800 D98.tmp 33 PID 2800 wrote to memory of 2984 2800 D98.tmp 33 PID 2984 wrote to memory of 2868 2984 E14.tmp 34 PID 2984 wrote to memory of 2868 2984 E14.tmp 34 PID 2984 wrote to memory of 2868 2984 E14.tmp 34 PID 2984 wrote to memory of 2868 2984 E14.tmp 34 PID 2868 wrote to memory of 2548 2868 E72.tmp 35 PID 2868 wrote to memory of 2548 2868 E72.tmp 35 PID 2868 wrote to memory of 2548 2868 E72.tmp 35 PID 2868 wrote to memory of 2548 2868 E72.tmp 35 PID 2548 wrote to memory of 2380 2548 ED0.tmp 36 PID 2548 wrote to memory of 2380 2548 ED0.tmp 36 PID 2548 wrote to memory of 2380 2548 ED0.tmp 36 PID 2548 wrote to memory of 2380 2548 ED0.tmp 36 PID 2380 wrote to memory of 2452 2380 F2D.tmp 37 PID 2380 wrote to memory of 2452 2380 F2D.tmp 37 PID 2380 wrote to memory of 2452 2380 F2D.tmp 37 PID 2380 wrote to memory of 2452 2380 F2D.tmp 37 PID 2452 wrote to memory of 3056 2452 F9A.tmp 38 PID 2452 wrote to memory of 3056 2452 F9A.tmp 38 PID 2452 wrote to memory of 3056 2452 F9A.tmp 38 PID 2452 wrote to memory of 3056 2452 F9A.tmp 38 PID 3056 wrote to memory of 1912 3056 FF8.tmp 39 PID 3056 wrote to memory of 1912 3056 FF8.tmp 39 PID 3056 wrote to memory of 1912 3056 FF8.tmp 39 PID 3056 wrote to memory of 1912 3056 FF8.tmp 39 PID 1912 wrote to memory of 2688 1912 1056.tmp 40 PID 1912 wrote to memory of 2688 1912 1056.tmp 40 PID 1912 wrote to memory of 2688 1912 1056.tmp 40 PID 1912 wrote to memory of 2688 1912 1056.tmp 40 PID 2688 wrote to memory of 2704 2688 10B3.tmp 41 PID 2688 wrote to memory of 2704 2688 10B3.tmp 41 PID 2688 wrote to memory of 2704 2688 10B3.tmp 41 PID 2688 wrote to memory of 2704 2688 10B3.tmp 41 PID 2704 wrote to memory of 1872 2704 1120.tmp 42 PID 2704 wrote to memory of 1872 2704 1120.tmp 42 PID 2704 wrote to memory of 1872 2704 1120.tmp 42 PID 2704 wrote to memory of 1872 2704 1120.tmp 42 PID 1872 wrote to memory of 1856 1872 117E.tmp 43 PID 1872 wrote to memory of 1856 1872 117E.tmp 43 PID 1872 wrote to memory of 1856 1872 117E.tmp 43 PID 1872 wrote to memory of 1856 1872 117E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_51a56aaae321b64ad21f40a1c6aa3070_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D98.tmp"C:\Users\Admin\AppData\Local\Temp\D98.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:656 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"65⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"66⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"67⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"68⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"69⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"70⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"71⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"72⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"73⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"74⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"75⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"76⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"77⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"78⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"79⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"80⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"81⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"82⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"83⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"84⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"86⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"87⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"88⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"89⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"90⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"92⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"93⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"94⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"95⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"96⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"97⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"98⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"99⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"100⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"101⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"102⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"103⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"104⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"105⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"106⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"107⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"108⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"109⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"110⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"111⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"112⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"113⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"114⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"115⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"116⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"117⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"118⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"119⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"120⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"121⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"122⤵PID:1844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-