Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe
-
Size
541KB
-
MD5
22de33a51e8326ba75668f35e8e2442c
-
SHA1
f577c1d36dbd6840d49012c6d9fa8ae9f6228a37
-
SHA256
c3c1a40b3254bb8cf733a1d922c0c1cca0daf6176c8953db07eb48d90bad9bf7
-
SHA512
bf98001dcabf8d7fc2c62caa6fc68286d19f2c3ede528a8ad18c6887c45d5bd0104bdb0a990b04502e43cda306fdbd35d6d9e45aa19aea5aa7f5e62277917fb4
-
SSDEEP
12288:UU5rCOTeifJrQud79d+5qxF4GdIZKrZa73ctO:UUQOJfV1p9dvGKrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1932 142C.tmp 2216 149A.tmp 2540 1516.tmp 2592 1584.tmp 2688 15F1.tmp 2580 165E.tmp 2736 16CB.tmp 2472 1729.tmp 2696 1796.tmp 2464 1803.tmp 2196 1861.tmp 3048 18BE.tmp 1960 191C.tmp 2768 197A.tmp 2864 19E7.tmp 552 1A54.tmp 1928 1AC1.tmp 2344 1B1F.tmp 2228 1B8C.tmp 1248 1BEA.tmp 1616 1C47.tmp 2244 1CB4.tmp 1520 1D02.tmp 632 1D50.tmp 2304 1D8F.tmp 2260 1DDD.tmp 2288 1E2B.tmp 2776 1E69.tmp 2172 1EA8.tmp 1252 1EE6.tmp 268 1F24.tmp 796 1F72.tmp 1020 1FB1.tmp 1632 1FEF.tmp 1292 203D.tmp 1240 207C.tmp 2420 20BA.tmp 3064 20F8.tmp 1132 2137.tmp 2176 2175.tmp 404 21B4.tmp 1540 21F2.tmp 916 2230.tmp 1264 226F.tmp 1044 22AD.tmp 2824 22EC.tmp 844 232A.tmp 2220 2368.tmp 2036 23A7.tmp 1084 23E5.tmp 992 2424.tmp 864 2462.tmp 2168 24A0.tmp 1740 24DF.tmp 2848 251D.tmp 1804 255C.tmp 1604 259A.tmp 1572 25D8.tmp 1932 2617.tmp 1852 2665.tmp 2716 26A3.tmp 2960 26E2.tmp 2680 2720.tmp 2668 277E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2796 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 1932 142C.tmp 2216 149A.tmp 2540 1516.tmp 2592 1584.tmp 2688 15F1.tmp 2580 165E.tmp 2736 16CB.tmp 2472 1729.tmp 2696 1796.tmp 2464 1803.tmp 2196 1861.tmp 3048 18BE.tmp 1960 191C.tmp 2768 197A.tmp 2864 19E7.tmp 552 1A54.tmp 1928 1AC1.tmp 2344 1B1F.tmp 2228 1B8C.tmp 1248 1BEA.tmp 1616 1C47.tmp 2244 1CB4.tmp 1520 1D02.tmp 632 1D50.tmp 2304 1D8F.tmp 2260 1DDD.tmp 2288 1E2B.tmp 2776 1E69.tmp 2172 1EA8.tmp 1252 1EE6.tmp 268 1F24.tmp 796 1F72.tmp 1020 1FB1.tmp 1632 1FEF.tmp 1292 203D.tmp 1240 207C.tmp 2420 20BA.tmp 3064 20F8.tmp 1132 2137.tmp 2176 2175.tmp 404 21B4.tmp 1540 21F2.tmp 916 2230.tmp 1264 226F.tmp 1044 22AD.tmp 2824 22EC.tmp 844 232A.tmp 2220 2368.tmp 2036 23A7.tmp 1084 23E5.tmp 992 2424.tmp 864 2462.tmp 2168 24A0.tmp 1740 24DF.tmp 2848 251D.tmp 1804 255C.tmp 1604 259A.tmp 1572 25D8.tmp 1932 2617.tmp 1852 2665.tmp 2716 26A3.tmp 2960 26E2.tmp 2680 2720.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1932 2796 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 28 PID 2796 wrote to memory of 1932 2796 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 28 PID 2796 wrote to memory of 1932 2796 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 28 PID 2796 wrote to memory of 1932 2796 2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe 28 PID 1932 wrote to memory of 2216 1932 142C.tmp 29 PID 1932 wrote to memory of 2216 1932 142C.tmp 29 PID 1932 wrote to memory of 2216 1932 142C.tmp 29 PID 1932 wrote to memory of 2216 1932 142C.tmp 29 PID 2216 wrote to memory of 2540 2216 149A.tmp 30 PID 2216 wrote to memory of 2540 2216 149A.tmp 30 PID 2216 wrote to memory of 2540 2216 149A.tmp 30 PID 2216 wrote to memory of 2540 2216 149A.tmp 30 PID 2540 wrote to memory of 2592 2540 1516.tmp 31 PID 2540 wrote to memory of 2592 2540 1516.tmp 31 PID 2540 wrote to memory of 2592 2540 1516.tmp 31 PID 2540 wrote to memory of 2592 2540 1516.tmp 31 PID 2592 wrote to memory of 2688 2592 1584.tmp 32 PID 2592 wrote to memory of 2688 2592 1584.tmp 32 PID 2592 wrote to memory of 2688 2592 1584.tmp 32 PID 2592 wrote to memory of 2688 2592 1584.tmp 32 PID 2688 wrote to memory of 2580 2688 15F1.tmp 33 PID 2688 wrote to memory of 2580 2688 15F1.tmp 33 PID 2688 wrote to memory of 2580 2688 15F1.tmp 33 PID 2688 wrote to memory of 2580 2688 15F1.tmp 33 PID 2580 wrote to memory of 2736 2580 165E.tmp 34 PID 2580 wrote to memory of 2736 2580 165E.tmp 34 PID 2580 wrote to memory of 2736 2580 165E.tmp 34 PID 2580 wrote to memory of 2736 2580 165E.tmp 34 PID 2736 wrote to memory of 2472 2736 16CB.tmp 35 PID 2736 wrote to memory of 2472 2736 16CB.tmp 35 PID 2736 wrote to memory of 2472 2736 16CB.tmp 35 PID 2736 wrote to memory of 2472 2736 16CB.tmp 35 PID 2472 wrote to memory of 2696 2472 1729.tmp 36 PID 2472 wrote to memory of 2696 2472 1729.tmp 36 PID 2472 wrote to memory of 2696 2472 1729.tmp 36 PID 2472 wrote to memory of 2696 2472 1729.tmp 36 PID 2696 wrote to memory of 2464 2696 1796.tmp 37 PID 2696 wrote to memory of 2464 2696 1796.tmp 37 PID 2696 wrote to memory of 2464 2696 1796.tmp 37 PID 2696 wrote to memory of 2464 2696 1796.tmp 37 PID 2464 wrote to memory of 2196 2464 1803.tmp 38 PID 2464 wrote to memory of 2196 2464 1803.tmp 38 PID 2464 wrote to memory of 2196 2464 1803.tmp 38 PID 2464 wrote to memory of 2196 2464 1803.tmp 38 PID 2196 wrote to memory of 3048 2196 1861.tmp 39 PID 2196 wrote to memory of 3048 2196 1861.tmp 39 PID 2196 wrote to memory of 3048 2196 1861.tmp 39 PID 2196 wrote to memory of 3048 2196 1861.tmp 39 PID 3048 wrote to memory of 1960 3048 18BE.tmp 40 PID 3048 wrote to memory of 1960 3048 18BE.tmp 40 PID 3048 wrote to memory of 1960 3048 18BE.tmp 40 PID 3048 wrote to memory of 1960 3048 18BE.tmp 40 PID 1960 wrote to memory of 2768 1960 191C.tmp 41 PID 1960 wrote to memory of 2768 1960 191C.tmp 41 PID 1960 wrote to memory of 2768 1960 191C.tmp 41 PID 1960 wrote to memory of 2768 1960 191C.tmp 41 PID 2768 wrote to memory of 2864 2768 197A.tmp 42 PID 2768 wrote to memory of 2864 2768 197A.tmp 42 PID 2768 wrote to memory of 2864 2768 197A.tmp 42 PID 2768 wrote to memory of 2864 2768 197A.tmp 42 PID 2864 wrote to memory of 552 2864 19E7.tmp 43 PID 2864 wrote to memory of 552 2864 19E7.tmp 43 PID 2864 wrote to memory of 552 2864 19E7.tmp 43 PID 2864 wrote to memory of 552 2864 19E7.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_22de33a51e8326ba75668f35e8e2442c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"65⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"66⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"67⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"68⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"69⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"70⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"71⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"72⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"73⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"74⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"75⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"76⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"77⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"78⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"79⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"80⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"81⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"82⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"83⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"84⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"85⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"86⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"87⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"88⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"89⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"91⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"92⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"93⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"94⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"95⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"96⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"97⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"98⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"99⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"100⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"101⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"102⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"103⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"105⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"106⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"107⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"108⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"109⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"110⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"111⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"112⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"113⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"114⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"115⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"116⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"117⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"118⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"119⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"120⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"121⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"122⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-