Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe
-
Size
486KB
-
MD5
0893584a3bfc10491db4ceca4111d650
-
SHA1
eabb682626597828051bb4939bbdaef31206c00d
-
SHA256
f22a47f9ae690d1e32e2c741a511ba8a734302dd4fdbac69016fd5675ba9882c
-
SHA512
274db1085024909b9b589caf5a3c09258633dcf854579241353f73ad5763166bf039cd215ce409ef0f9b12d273994d9f5eccf99ba13dc3ad505f6b729c2fe319
-
SSDEEP
12288:UU5rCOTeiDIOvl0XrAgaYnWo9ImT2F4hnpNZ:UUQOJDo7AgaYamO4hnpN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1248 1268.tmp 1812 12D5.tmp 2684 1352.tmp 2680 13CF.tmp 2760 142C.tmp 2776 149A.tmp 2628 14F7.tmp 2728 1564.tmp 2560 15D2.tmp 3068 163F.tmp 1584 16AC.tmp 2588 1719.tmp 2712 1786.tmp 2844 17F4.tmp 1612 1861.tmp 1540 18BE.tmp 340 192C.tmp 1860 1989.tmp 276 19F6.tmp 2548 1A64.tmp 1512 1AD1.tmp 1444 1B3E.tmp 3024 1B8C.tmp 2984 1BCA.tmp 1912 1C09.tmp 2016 1C47.tmp 2832 1C86.tmp 2312 1CC4.tmp 600 1D02.tmp 484 1D41.tmp 644 1D70.tmp 2020 1DAE.tmp 2980 1DEC.tmp 1576 1E5A.tmp 1712 1EA8.tmp 2104 1EF6.tmp 448 1F53.tmp 2300 1FA1.tmp 1700 1FFF.tmp 792 204D.tmp 1604 209B.tmp 1292 20D9.tmp 1592 2127.tmp 1916 2166.tmp 924 21A4.tmp 2200 21F2.tmp 3052 2230.tmp 1648 226F.tmp 828 22AD.tmp 2936 22EC.tmp 2168 232A.tmp 2164 2368.tmp 904 23A7.tmp 2184 23E5.tmp 1988 2424.tmp 1336 2462.tmp 2076 24B0.tmp 2148 24EE.tmp 2648 252D.tmp 1812 258A.tmp 2692 25D8.tmp 2652 2617.tmp 2740 2655.tmp 2608 2694.tmp -
Loads dropped DLL 64 IoCs
pid Process 2084 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 1248 1268.tmp 1812 12D5.tmp 2684 1352.tmp 2680 13CF.tmp 2760 142C.tmp 2776 149A.tmp 2628 14F7.tmp 2728 1564.tmp 2560 15D2.tmp 3068 163F.tmp 1584 16AC.tmp 2588 1719.tmp 2712 1786.tmp 2844 17F4.tmp 1612 1861.tmp 1540 18BE.tmp 340 192C.tmp 1860 1989.tmp 276 19F6.tmp 2548 1A64.tmp 1512 1AD1.tmp 1444 1B3E.tmp 3024 1B8C.tmp 2984 1BCA.tmp 1912 1C09.tmp 2016 1C47.tmp 2832 1C86.tmp 2312 1CC4.tmp 600 1D02.tmp 484 1D41.tmp 644 1D70.tmp 2020 1DAE.tmp 2980 1DEC.tmp 1576 1E5A.tmp 1712 1EA8.tmp 2104 1EF6.tmp 448 1F53.tmp 2300 1FA1.tmp 1700 1FFF.tmp 792 204D.tmp 1604 209B.tmp 1292 20D9.tmp 1592 2127.tmp 1916 2166.tmp 924 21A4.tmp 2200 21F2.tmp 3052 2230.tmp 1648 226F.tmp 828 22AD.tmp 2936 22EC.tmp 2168 232A.tmp 2164 2368.tmp 904 23A7.tmp 2184 23E5.tmp 1988 2424.tmp 1336 2462.tmp 2076 24B0.tmp 2148 24EE.tmp 2648 252D.tmp 1812 258A.tmp 2692 25D8.tmp 2652 2617.tmp 2740 2655.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 1248 2084 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 28 PID 2084 wrote to memory of 1248 2084 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 28 PID 2084 wrote to memory of 1248 2084 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 28 PID 2084 wrote to memory of 1248 2084 2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe 28 PID 1248 wrote to memory of 1812 1248 1268.tmp 29 PID 1248 wrote to memory of 1812 1248 1268.tmp 29 PID 1248 wrote to memory of 1812 1248 1268.tmp 29 PID 1248 wrote to memory of 1812 1248 1268.tmp 29 PID 1812 wrote to memory of 2684 1812 12D5.tmp 30 PID 1812 wrote to memory of 2684 1812 12D5.tmp 30 PID 1812 wrote to memory of 2684 1812 12D5.tmp 30 PID 1812 wrote to memory of 2684 1812 12D5.tmp 30 PID 2684 wrote to memory of 2680 2684 1352.tmp 31 PID 2684 wrote to memory of 2680 2684 1352.tmp 31 PID 2684 wrote to memory of 2680 2684 1352.tmp 31 PID 2684 wrote to memory of 2680 2684 1352.tmp 31 PID 2680 wrote to memory of 2760 2680 13CF.tmp 32 PID 2680 wrote to memory of 2760 2680 13CF.tmp 32 PID 2680 wrote to memory of 2760 2680 13CF.tmp 32 PID 2680 wrote to memory of 2760 2680 13CF.tmp 32 PID 2760 wrote to memory of 2776 2760 142C.tmp 33 PID 2760 wrote to memory of 2776 2760 142C.tmp 33 PID 2760 wrote to memory of 2776 2760 142C.tmp 33 PID 2760 wrote to memory of 2776 2760 142C.tmp 33 PID 2776 wrote to memory of 2628 2776 149A.tmp 34 PID 2776 wrote to memory of 2628 2776 149A.tmp 34 PID 2776 wrote to memory of 2628 2776 149A.tmp 34 PID 2776 wrote to memory of 2628 2776 149A.tmp 34 PID 2628 wrote to memory of 2728 2628 14F7.tmp 35 PID 2628 wrote to memory of 2728 2628 14F7.tmp 35 PID 2628 wrote to memory of 2728 2628 14F7.tmp 35 PID 2628 wrote to memory of 2728 2628 14F7.tmp 35 PID 2728 wrote to memory of 2560 2728 1564.tmp 36 PID 2728 wrote to memory of 2560 2728 1564.tmp 36 PID 2728 wrote to memory of 2560 2728 1564.tmp 36 PID 2728 wrote to memory of 2560 2728 1564.tmp 36 PID 2560 wrote to memory of 3068 2560 15D2.tmp 37 PID 2560 wrote to memory of 3068 2560 15D2.tmp 37 PID 2560 wrote to memory of 3068 2560 15D2.tmp 37 PID 2560 wrote to memory of 3068 2560 15D2.tmp 37 PID 3068 wrote to memory of 1584 3068 163F.tmp 38 PID 3068 wrote to memory of 1584 3068 163F.tmp 38 PID 3068 wrote to memory of 1584 3068 163F.tmp 38 PID 3068 wrote to memory of 1584 3068 163F.tmp 38 PID 1584 wrote to memory of 2588 1584 16AC.tmp 39 PID 1584 wrote to memory of 2588 1584 16AC.tmp 39 PID 1584 wrote to memory of 2588 1584 16AC.tmp 39 PID 1584 wrote to memory of 2588 1584 16AC.tmp 39 PID 2588 wrote to memory of 2712 2588 1719.tmp 40 PID 2588 wrote to memory of 2712 2588 1719.tmp 40 PID 2588 wrote to memory of 2712 2588 1719.tmp 40 PID 2588 wrote to memory of 2712 2588 1719.tmp 40 PID 2712 wrote to memory of 2844 2712 1786.tmp 41 PID 2712 wrote to memory of 2844 2712 1786.tmp 41 PID 2712 wrote to memory of 2844 2712 1786.tmp 41 PID 2712 wrote to memory of 2844 2712 1786.tmp 41 PID 2844 wrote to memory of 1612 2844 17F4.tmp 42 PID 2844 wrote to memory of 1612 2844 17F4.tmp 42 PID 2844 wrote to memory of 1612 2844 17F4.tmp 42 PID 2844 wrote to memory of 1612 2844 17F4.tmp 42 PID 1612 wrote to memory of 1540 1612 1861.tmp 43 PID 1612 wrote to memory of 1540 1612 1861.tmp 43 PID 1612 wrote to memory of 1540 1612 1861.tmp 43 PID 1612 wrote to memory of 1540 1612 1861.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_0893584a3bfc10491db4ceca4111d650_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"66⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"67⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"69⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"70⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"71⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"72⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"73⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"74⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"75⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"76⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"77⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"78⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"79⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"80⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"81⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"82⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"83⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"84⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"85⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"86⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"87⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"88⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"89⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"90⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"91⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"92⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"93⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"94⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"95⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"96⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"97⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"98⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"99⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"100⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"101⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"102⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"103⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"104⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"105⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"106⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"107⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"108⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"109⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"110⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"111⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"112⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"113⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"114⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"115⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"116⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"117⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"118⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"119⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"120⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"121⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"122⤵PID:2436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-