Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe
-
Size
527KB
-
MD5
2545b753c4cfebe82bba961831ff72b4
-
SHA1
ff993b5d4cb9c0c7753b1fb9e1e9787387a53c3d
-
SHA256
24189912da92d9fc092ffd18232dc9b9fd001ac16ef599aeb26b93422525b84a
-
SHA512
288b1257e69ab550abfd96ecc01807815fb19bfd3221ca9d6fe8332dd872f7728412375b4ffe9035b522f0f754e3ee0d117debbba6bcb62aa9840d01d16bd679
-
SSDEEP
12288:fU5rCOTeid3Vs9C/QmA835xWOJSpPaDZu:fUQOJd3Vb/S82bdaDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2300 14C8.tmp 2580 1536.tmp 2688 15B2.tmp 2616 1620.tmp 2844 169C.tmp 2808 1719.tmp 2636 1786.tmp 2464 17F4.tmp 2592 1870.tmp 2112 18DE.tmp 2428 194B.tmp 896 19D7.tmp 2444 1A35.tmp 1444 1A92.tmp 1728 1B00.tmp 1448 1B6D.tmp 340 1BDA.tmp 2380 1C38.tmp 1744 1CC4.tmp 316 1D22.tmp 2028 1D8F.tmp 2824 1DEC.tmp 2804 1E69.tmp 3036 1EA8.tmp 1156 1EF6.tmp 2236 1F34.tmp 2308 1F82.tmp 320 1FD0.tmp 484 200E.tmp 1416 204D.tmp 2872 209B.tmp 2560 20E9.tmp 1140 2137.tmp 1696 2175.tmp 2284 21C3.tmp 408 2211.tmp 3040 225F.tmp 356 22AD.tmp 1700 22EC.tmp 2136 233A.tmp 1304 2388.tmp 236 23C6.tmp 900 2414.tmp 920 2462.tmp 2648 24A0.tmp 1216 24EE.tmp 1908 253C.tmp 1916 258A.tmp 988 25C9.tmp 1664 2607.tmp 568 2655.tmp 1472 2694.tmp 2420 26E2.tmp 1944 2720.tmp 2252 276E.tmp 1532 27CC.tmp 3068 280A.tmp 2300 2848.tmp 2848 2896.tmp 2624 28D5.tmp 2696 2913.tmp 2780 2952.tmp 2492 29A0.tmp 2312 29DE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2252 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 2300 14C8.tmp 2580 1536.tmp 2688 15B2.tmp 2616 1620.tmp 2844 169C.tmp 2808 1719.tmp 2636 1786.tmp 2464 17F4.tmp 2592 1870.tmp 2112 18DE.tmp 2428 194B.tmp 896 19D7.tmp 2444 1A35.tmp 1444 1A92.tmp 1728 1B00.tmp 1448 1B6D.tmp 340 1BDA.tmp 2380 1C38.tmp 1744 1CC4.tmp 316 1D22.tmp 2028 1D8F.tmp 2824 1DEC.tmp 2804 1E69.tmp 3036 1EA8.tmp 1156 1EF6.tmp 2236 1F34.tmp 2308 1F82.tmp 320 1FD0.tmp 484 200E.tmp 1416 204D.tmp 2872 209B.tmp 2560 20E9.tmp 1140 2137.tmp 1696 2175.tmp 2284 21C3.tmp 408 2211.tmp 3040 225F.tmp 356 22AD.tmp 1700 22EC.tmp 2136 233A.tmp 1304 2388.tmp 236 23C6.tmp 900 2414.tmp 920 2462.tmp 2648 24A0.tmp 1216 24EE.tmp 1908 253C.tmp 1916 258A.tmp 988 25C9.tmp 1664 2607.tmp 568 2655.tmp 1472 2694.tmp 2420 26E2.tmp 1944 2720.tmp 2252 276E.tmp 1532 27CC.tmp 3068 280A.tmp 2300 2848.tmp 2848 2896.tmp 2624 28D5.tmp 2696 2913.tmp 2780 2952.tmp 2492 29A0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2300 2252 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 28 PID 2252 wrote to memory of 2300 2252 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 28 PID 2252 wrote to memory of 2300 2252 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 28 PID 2252 wrote to memory of 2300 2252 2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe 28 PID 2300 wrote to memory of 2580 2300 14C8.tmp 29 PID 2300 wrote to memory of 2580 2300 14C8.tmp 29 PID 2300 wrote to memory of 2580 2300 14C8.tmp 29 PID 2300 wrote to memory of 2580 2300 14C8.tmp 29 PID 2580 wrote to memory of 2688 2580 1536.tmp 30 PID 2580 wrote to memory of 2688 2580 1536.tmp 30 PID 2580 wrote to memory of 2688 2580 1536.tmp 30 PID 2580 wrote to memory of 2688 2580 1536.tmp 30 PID 2688 wrote to memory of 2616 2688 15B2.tmp 31 PID 2688 wrote to memory of 2616 2688 15B2.tmp 31 PID 2688 wrote to memory of 2616 2688 15B2.tmp 31 PID 2688 wrote to memory of 2616 2688 15B2.tmp 31 PID 2616 wrote to memory of 2844 2616 1620.tmp 32 PID 2616 wrote to memory of 2844 2616 1620.tmp 32 PID 2616 wrote to memory of 2844 2616 1620.tmp 32 PID 2616 wrote to memory of 2844 2616 1620.tmp 32 PID 2844 wrote to memory of 2808 2844 169C.tmp 33 PID 2844 wrote to memory of 2808 2844 169C.tmp 33 PID 2844 wrote to memory of 2808 2844 169C.tmp 33 PID 2844 wrote to memory of 2808 2844 169C.tmp 33 PID 2808 wrote to memory of 2636 2808 1719.tmp 34 PID 2808 wrote to memory of 2636 2808 1719.tmp 34 PID 2808 wrote to memory of 2636 2808 1719.tmp 34 PID 2808 wrote to memory of 2636 2808 1719.tmp 34 PID 2636 wrote to memory of 2464 2636 1786.tmp 35 PID 2636 wrote to memory of 2464 2636 1786.tmp 35 PID 2636 wrote to memory of 2464 2636 1786.tmp 35 PID 2636 wrote to memory of 2464 2636 1786.tmp 35 PID 2464 wrote to memory of 2592 2464 17F4.tmp 36 PID 2464 wrote to memory of 2592 2464 17F4.tmp 36 PID 2464 wrote to memory of 2592 2464 17F4.tmp 36 PID 2464 wrote to memory of 2592 2464 17F4.tmp 36 PID 2592 wrote to memory of 2112 2592 1870.tmp 37 PID 2592 wrote to memory of 2112 2592 1870.tmp 37 PID 2592 wrote to memory of 2112 2592 1870.tmp 37 PID 2592 wrote to memory of 2112 2592 1870.tmp 37 PID 2112 wrote to memory of 2428 2112 18DE.tmp 38 PID 2112 wrote to memory of 2428 2112 18DE.tmp 38 PID 2112 wrote to memory of 2428 2112 18DE.tmp 38 PID 2112 wrote to memory of 2428 2112 18DE.tmp 38 PID 2428 wrote to memory of 896 2428 194B.tmp 39 PID 2428 wrote to memory of 896 2428 194B.tmp 39 PID 2428 wrote to memory of 896 2428 194B.tmp 39 PID 2428 wrote to memory of 896 2428 194B.tmp 39 PID 896 wrote to memory of 2444 896 19D7.tmp 40 PID 896 wrote to memory of 2444 896 19D7.tmp 40 PID 896 wrote to memory of 2444 896 19D7.tmp 40 PID 896 wrote to memory of 2444 896 19D7.tmp 40 PID 2444 wrote to memory of 1444 2444 1A35.tmp 41 PID 2444 wrote to memory of 1444 2444 1A35.tmp 41 PID 2444 wrote to memory of 1444 2444 1A35.tmp 41 PID 2444 wrote to memory of 1444 2444 1A35.tmp 41 PID 1444 wrote to memory of 1728 1444 1A92.tmp 42 PID 1444 wrote to memory of 1728 1444 1A92.tmp 42 PID 1444 wrote to memory of 1728 1444 1A92.tmp 42 PID 1444 wrote to memory of 1728 1444 1A92.tmp 42 PID 1728 wrote to memory of 1448 1728 1B00.tmp 43 PID 1728 wrote to memory of 1448 1728 1B00.tmp 43 PID 1728 wrote to memory of 1448 1728 1B00.tmp 43 PID 1728 wrote to memory of 1448 1728 1B00.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_2545b753c4cfebe82bba961831ff72b4_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"65⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"66⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"67⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"68⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"69⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"70⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"71⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"72⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"73⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"74⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"75⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"76⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"77⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"78⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"79⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"80⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"81⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"82⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"83⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"84⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"85⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"86⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"87⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"88⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"89⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"90⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"91⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"92⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"93⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"94⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"95⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"96⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"97⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"98⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"99⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"100⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"101⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"102⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"103⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"104⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"105⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"106⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"107⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"108⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"109⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"110⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"111⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"112⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"113⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"114⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"115⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"116⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"117⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"118⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"119⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"120⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"121⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-