Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 02:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe
-
Size
530KB
-
MD5
81e728717f96509e7133c43643f50bfc
-
SHA1
f4cf6bd9d089c78b3244cd7ef2dde67877a29829
-
SHA256
431d7e16b9591e2beed53b3c0794b44f5d184e2c01a60161db79f50a27a77012
-
SHA512
ce69565ef9921de1731b0bb760a37581f0d98c82068a9899c3a0e5f1117901efb54569dd91e6a7f915844df855c88ed192cd24935bb3f435b73c41f93929e090
-
SSDEEP
12288:AU5rCOTeiozSxu5gT54a/cxSIROuNZulFVg0M1:AUQOJoz0ui53/aTUuNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2964 D0B.tmp 3068 D69.tmp 2556 DD6.tmp 2604 E34.tmp 2716 EA1.tmp 2588 F0E.tmp 2700 F7B.tmp 2644 FE8.tmp 2732 1056.tmp 2476 10B3.tmp 2632 1120.tmp 3032 117E.tmp 320 11EB.tmp 1700 1249.tmp 2440 12A6.tmp 2704 1304.tmp 812 1362.tmp 1980 13BF.tmp 2376 141D.tmp 800 148A.tmp 1816 14E8.tmp 2372 1555.tmp 1544 15B2.tmp 1344 1600.tmp 2100 164E.tmp 2560 168D.tmp 2884 16EA.tmp 2444 1738.tmp 1720 1786.tmp 2068 17C5.tmp 2996 1813.tmp 704 1861.tmp 928 189F.tmp 1664 18ED.tmp 552 193B.tmp 820 1989.tmp 2432 19D7.tmp 2788 1A25.tmp 2152 1A73.tmp 3016 1AC1.tmp 1396 1B00.tmp 1560 1B4E.tmp 968 1B9C.tmp 1908 1BEA.tmp 2044 1C28.tmp 1796 1C76.tmp 1012 1CC4.tmp 2296 1D02.tmp 2132 1D41.tmp 1680 1D8F.tmp 600 1DCD.tmp 2912 1E0C.tmp 892 1E5A.tmp 2204 1E98.tmp 2744 1EE6.tmp 1620 1F24.tmp 2956 1F72.tmp 3044 1FB1.tmp 2972 1FEF.tmp 1296 202E.tmp 2928 207C.tmp 2612 20BA.tmp 2676 2108.tmp 2720 2146.tmp -
Loads dropped DLL 64 IoCs
pid Process 2924 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 2964 D0B.tmp 3068 D69.tmp 2556 DD6.tmp 2604 E34.tmp 2716 EA1.tmp 2588 F0E.tmp 2700 F7B.tmp 2644 FE8.tmp 2732 1056.tmp 2476 10B3.tmp 2632 1120.tmp 3032 117E.tmp 320 11EB.tmp 1700 1249.tmp 2440 12A6.tmp 2704 1304.tmp 812 1362.tmp 1980 13BF.tmp 2376 141D.tmp 800 148A.tmp 1816 14E8.tmp 2372 1555.tmp 1544 15B2.tmp 1344 1600.tmp 2100 164E.tmp 2560 168D.tmp 2884 16EA.tmp 2444 1738.tmp 1720 1786.tmp 2068 17C5.tmp 2996 1813.tmp 704 1861.tmp 928 189F.tmp 1664 18ED.tmp 552 193B.tmp 820 1989.tmp 2432 19D7.tmp 2788 1A25.tmp 2152 1A73.tmp 3016 1AC1.tmp 1396 1B00.tmp 1560 1B4E.tmp 968 1B9C.tmp 1908 1BEA.tmp 2044 1C28.tmp 1796 1C76.tmp 1012 1CC4.tmp 2296 1D02.tmp 2132 1D41.tmp 1680 1D8F.tmp 600 1DCD.tmp 2912 1E0C.tmp 892 1E5A.tmp 2204 1E98.tmp 2744 1EE6.tmp 1620 1F24.tmp 2956 1F72.tmp 3044 1FB1.tmp 2972 1FEF.tmp 1296 202E.tmp 2928 207C.tmp 2612 20BA.tmp 2676 2108.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2964 2924 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 28 PID 2924 wrote to memory of 2964 2924 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 28 PID 2924 wrote to memory of 2964 2924 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 28 PID 2924 wrote to memory of 2964 2924 2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe 28 PID 2964 wrote to memory of 3068 2964 D0B.tmp 29 PID 2964 wrote to memory of 3068 2964 D0B.tmp 29 PID 2964 wrote to memory of 3068 2964 D0B.tmp 29 PID 2964 wrote to memory of 3068 2964 D0B.tmp 29 PID 3068 wrote to memory of 2556 3068 D69.tmp 30 PID 3068 wrote to memory of 2556 3068 D69.tmp 30 PID 3068 wrote to memory of 2556 3068 D69.tmp 30 PID 3068 wrote to memory of 2556 3068 D69.tmp 30 PID 2556 wrote to memory of 2604 2556 DD6.tmp 31 PID 2556 wrote to memory of 2604 2556 DD6.tmp 31 PID 2556 wrote to memory of 2604 2556 DD6.tmp 31 PID 2556 wrote to memory of 2604 2556 DD6.tmp 31 PID 2604 wrote to memory of 2716 2604 E34.tmp 32 PID 2604 wrote to memory of 2716 2604 E34.tmp 32 PID 2604 wrote to memory of 2716 2604 E34.tmp 32 PID 2604 wrote to memory of 2716 2604 E34.tmp 32 PID 2716 wrote to memory of 2588 2716 EA1.tmp 33 PID 2716 wrote to memory of 2588 2716 EA1.tmp 33 PID 2716 wrote to memory of 2588 2716 EA1.tmp 33 PID 2716 wrote to memory of 2588 2716 EA1.tmp 33 PID 2588 wrote to memory of 2700 2588 F0E.tmp 34 PID 2588 wrote to memory of 2700 2588 F0E.tmp 34 PID 2588 wrote to memory of 2700 2588 F0E.tmp 34 PID 2588 wrote to memory of 2700 2588 F0E.tmp 34 PID 2700 wrote to memory of 2644 2700 F7B.tmp 35 PID 2700 wrote to memory of 2644 2700 F7B.tmp 35 PID 2700 wrote to memory of 2644 2700 F7B.tmp 35 PID 2700 wrote to memory of 2644 2700 F7B.tmp 35 PID 2644 wrote to memory of 2732 2644 FE8.tmp 36 PID 2644 wrote to memory of 2732 2644 FE8.tmp 36 PID 2644 wrote to memory of 2732 2644 FE8.tmp 36 PID 2644 wrote to memory of 2732 2644 FE8.tmp 36 PID 2732 wrote to memory of 2476 2732 1056.tmp 37 PID 2732 wrote to memory of 2476 2732 1056.tmp 37 PID 2732 wrote to memory of 2476 2732 1056.tmp 37 PID 2732 wrote to memory of 2476 2732 1056.tmp 37 PID 2476 wrote to memory of 2632 2476 10B3.tmp 38 PID 2476 wrote to memory of 2632 2476 10B3.tmp 38 PID 2476 wrote to memory of 2632 2476 10B3.tmp 38 PID 2476 wrote to memory of 2632 2476 10B3.tmp 38 PID 2632 wrote to memory of 3032 2632 1120.tmp 39 PID 2632 wrote to memory of 3032 2632 1120.tmp 39 PID 2632 wrote to memory of 3032 2632 1120.tmp 39 PID 2632 wrote to memory of 3032 2632 1120.tmp 39 PID 3032 wrote to memory of 320 3032 117E.tmp 40 PID 3032 wrote to memory of 320 3032 117E.tmp 40 PID 3032 wrote to memory of 320 3032 117E.tmp 40 PID 3032 wrote to memory of 320 3032 117E.tmp 40 PID 320 wrote to memory of 1700 320 11EB.tmp 41 PID 320 wrote to memory of 1700 320 11EB.tmp 41 PID 320 wrote to memory of 1700 320 11EB.tmp 41 PID 320 wrote to memory of 1700 320 11EB.tmp 41 PID 1700 wrote to memory of 2440 1700 1249.tmp 42 PID 1700 wrote to memory of 2440 1700 1249.tmp 42 PID 1700 wrote to memory of 2440 1700 1249.tmp 42 PID 1700 wrote to memory of 2440 1700 1249.tmp 42 PID 2440 wrote to memory of 2704 2440 12A6.tmp 43 PID 2440 wrote to memory of 2704 2440 12A6.tmp 43 PID 2440 wrote to memory of 2704 2440 12A6.tmp 43 PID 2440 wrote to memory of 2704 2440 12A6.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_81e728717f96509e7133c43643f50bfc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1304.tmp"C:\Users\Admin\AppData\Local\Temp\1304.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"66⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"67⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"69⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"70⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"71⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"72⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"73⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"75⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"76⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"77⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"78⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"79⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"80⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"81⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"82⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"83⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"84⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"85⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"86⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"87⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"89⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"90⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"91⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"92⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"93⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"94⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"96⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"97⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"98⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"99⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"100⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"101⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"102⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"103⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"104⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"105⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"106⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"107⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"108⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"109⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"110⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"111⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"112⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"113⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"114⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"115⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"116⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"117⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"118⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"119⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"120⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"121⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-