Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe
-
Size
541KB
-
MD5
56d18bfcc4f395d94f00071b454746c0
-
SHA1
78815ef731bcc5116c718d1fb37bcdb141bbc772
-
SHA256
f3afde077b473a91a6718e9db053b501337d13bc8ee6dc6631f71a6218cdbd0f
-
SHA512
a2b54861c1f7f7e78a9b998dba766fcf894070d1523d5097b4d4e635106d95ad9ae66fd8b82f4106887cff288299b0f41fd4004ecd8dd37376ca1afab900ee08
-
SSDEEP
12288:UU5rCOTeifbdVKx/uue8/0MM5HHUS1bzrZa73ctO:UUQOJfK/LeSm5nUS1bzrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1288 15D2.tmp 1228 164E.tmp 1692 16DB.tmp 2644 1758.tmp 2800 17E4.tmp 2664 1870.tmp 2788 18FD.tmp 2756 197A.tmp 2580 19F6.tmp 2552 1A73.tmp 2220 1AF0.tmp 2992 1B7C.tmp 712 1C66.tmp 2836 1CE3.tmp 2864 1D41.tmp 2376 1DDD.tmp 2044 1E4A.tmp 864 1EC7.tmp 1768 1F34.tmp 1304 1FC0.tmp 560 202E.tmp 1564 20BA.tmp 1660 2127.tmp 1772 2175.tmp 2308 21C3.tmp 2276 2211.tmp 2636 2250.tmp 2212 229E.tmp 2936 22EC.tmp 2088 232A.tmp 588 2368.tmp 544 23B6.tmp 1628 23F5.tmp 1740 2443.tmp 668 2481.tmp 1100 24CF.tmp 236 250E.tmp 1152 255C.tmp 2300 259A.tmp 3060 25F8.tmp 1900 2665.tmp 1568 26B3.tmp 1368 26F1.tmp 2144 2730.tmp 1876 277E.tmp 1868 27CC.tmp 1160 281A.tmp 1456 2858.tmp 1264 28B6.tmp 852 28F4.tmp 1684 2932.tmp 2912 2971.tmp 3020 29AF.tmp 2068 29EE.tmp 2192 2A2C.tmp 2008 2A6A.tmp 3016 2AA9.tmp 2828 2AE7.tmp 2720 2B26.tmp 2648 2B64.tmp 3044 2BB2.tmp 2752 2C00.tmp 2644 2C3E.tmp 1544 2C8C.tmp -
Loads dropped DLL 64 IoCs
pid Process 1704 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 1288 15D2.tmp 1228 164E.tmp 1692 16DB.tmp 2644 1758.tmp 2800 17E4.tmp 2664 1870.tmp 2788 18FD.tmp 2756 197A.tmp 2580 19F6.tmp 2552 1A73.tmp 2220 1AF0.tmp 2992 1B7C.tmp 712 1C66.tmp 2836 1CE3.tmp 2864 1D41.tmp 2376 1DDD.tmp 2044 1E4A.tmp 864 1EC7.tmp 1768 1F34.tmp 1304 1FC0.tmp 560 202E.tmp 1564 20BA.tmp 1660 2127.tmp 1772 2175.tmp 2308 21C3.tmp 2276 2211.tmp 2636 2250.tmp 2212 229E.tmp 2936 22EC.tmp 2088 232A.tmp 588 2368.tmp 544 23B6.tmp 1628 23F5.tmp 1740 2443.tmp 668 2481.tmp 1100 24CF.tmp 236 250E.tmp 1152 255C.tmp 2300 259A.tmp 3060 25F8.tmp 1900 2665.tmp 1568 26B3.tmp 1368 26F1.tmp 2144 2730.tmp 1876 277E.tmp 1868 27CC.tmp 1160 281A.tmp 1456 2858.tmp 1264 28B6.tmp 852 28F4.tmp 1684 2932.tmp 2912 2971.tmp 3020 29AF.tmp 2068 29EE.tmp 2192 2A2C.tmp 2008 2A6A.tmp 3016 2AA9.tmp 2828 2AE7.tmp 2720 2B26.tmp 2648 2B64.tmp 3044 2BB2.tmp 2752 2C00.tmp 2644 2C3E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1288 1704 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 28 PID 1704 wrote to memory of 1288 1704 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 28 PID 1704 wrote to memory of 1288 1704 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 28 PID 1704 wrote to memory of 1288 1704 2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe 28 PID 1288 wrote to memory of 1228 1288 15D2.tmp 29 PID 1288 wrote to memory of 1228 1288 15D2.tmp 29 PID 1288 wrote to memory of 1228 1288 15D2.tmp 29 PID 1288 wrote to memory of 1228 1288 15D2.tmp 29 PID 1228 wrote to memory of 1692 1228 164E.tmp 30 PID 1228 wrote to memory of 1692 1228 164E.tmp 30 PID 1228 wrote to memory of 1692 1228 164E.tmp 30 PID 1228 wrote to memory of 1692 1228 164E.tmp 30 PID 1692 wrote to memory of 2644 1692 16DB.tmp 31 PID 1692 wrote to memory of 2644 1692 16DB.tmp 31 PID 1692 wrote to memory of 2644 1692 16DB.tmp 31 PID 1692 wrote to memory of 2644 1692 16DB.tmp 31 PID 2644 wrote to memory of 2800 2644 1758.tmp 32 PID 2644 wrote to memory of 2800 2644 1758.tmp 32 PID 2644 wrote to memory of 2800 2644 1758.tmp 32 PID 2644 wrote to memory of 2800 2644 1758.tmp 32 PID 2800 wrote to memory of 2664 2800 17E4.tmp 33 PID 2800 wrote to memory of 2664 2800 17E4.tmp 33 PID 2800 wrote to memory of 2664 2800 17E4.tmp 33 PID 2800 wrote to memory of 2664 2800 17E4.tmp 33 PID 2664 wrote to memory of 2788 2664 1870.tmp 34 PID 2664 wrote to memory of 2788 2664 1870.tmp 34 PID 2664 wrote to memory of 2788 2664 1870.tmp 34 PID 2664 wrote to memory of 2788 2664 1870.tmp 34 PID 2788 wrote to memory of 2756 2788 18FD.tmp 35 PID 2788 wrote to memory of 2756 2788 18FD.tmp 35 PID 2788 wrote to memory of 2756 2788 18FD.tmp 35 PID 2788 wrote to memory of 2756 2788 18FD.tmp 35 PID 2756 wrote to memory of 2580 2756 197A.tmp 36 PID 2756 wrote to memory of 2580 2756 197A.tmp 36 PID 2756 wrote to memory of 2580 2756 197A.tmp 36 PID 2756 wrote to memory of 2580 2756 197A.tmp 36 PID 2580 wrote to memory of 2552 2580 19F6.tmp 37 PID 2580 wrote to memory of 2552 2580 19F6.tmp 37 PID 2580 wrote to memory of 2552 2580 19F6.tmp 37 PID 2580 wrote to memory of 2552 2580 19F6.tmp 37 PID 2552 wrote to memory of 2220 2552 1A73.tmp 38 PID 2552 wrote to memory of 2220 2552 1A73.tmp 38 PID 2552 wrote to memory of 2220 2552 1A73.tmp 38 PID 2552 wrote to memory of 2220 2552 1A73.tmp 38 PID 2220 wrote to memory of 2992 2220 1AF0.tmp 39 PID 2220 wrote to memory of 2992 2220 1AF0.tmp 39 PID 2220 wrote to memory of 2992 2220 1AF0.tmp 39 PID 2220 wrote to memory of 2992 2220 1AF0.tmp 39 PID 2992 wrote to memory of 712 2992 1B7C.tmp 40 PID 2992 wrote to memory of 712 2992 1B7C.tmp 40 PID 2992 wrote to memory of 712 2992 1B7C.tmp 40 PID 2992 wrote to memory of 712 2992 1B7C.tmp 40 PID 712 wrote to memory of 2836 712 1C66.tmp 41 PID 712 wrote to memory of 2836 712 1C66.tmp 41 PID 712 wrote to memory of 2836 712 1C66.tmp 41 PID 712 wrote to memory of 2836 712 1C66.tmp 41 PID 2836 wrote to memory of 2864 2836 1CE3.tmp 42 PID 2836 wrote to memory of 2864 2836 1CE3.tmp 42 PID 2836 wrote to memory of 2864 2836 1CE3.tmp 42 PID 2836 wrote to memory of 2864 2836 1CE3.tmp 42 PID 2864 wrote to memory of 2376 2864 1D41.tmp 43 PID 2864 wrote to memory of 2376 2864 1D41.tmp 43 PID 2864 wrote to memory of 2376 2864 1D41.tmp 43 PID 2864 wrote to memory of 2376 2864 1D41.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_56d18bfcc4f395d94f00071b454746c0_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"65⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"66⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"67⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"68⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"69⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"70⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"71⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"72⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"73⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"74⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"75⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"76⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"78⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"79⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"80⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"81⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"82⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"83⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"84⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"85⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"86⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"87⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"88⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"89⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"90⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"91⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"92⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"93⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"94⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"95⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"96⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"98⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"99⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"100⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"101⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"102⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"103⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"104⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"105⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"106⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"107⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"108⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"110⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"111⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"112⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"113⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"114⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"115⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"116⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"117⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"118⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"119⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"120⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"121⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-