Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe
-
Size
520KB
-
MD5
b465a2cab42ba283330b7a0d9607bad3
-
SHA1
c43b5a9af1e5555a105b3d43537fdf0c227447c4
-
SHA256
5aba8c414cb5e22940283872b85efd88c013ac602fbaadde21247c00335e6871
-
SHA512
7c0cdf3b7ddf2f201694ff50ff4e8eae017a86452e03ffad3118426f8915ba6d563c57175dec828b901768cab11b959a87dc23971b6e8f4dbe4101c8fdf53a81
-
SSDEEP
12288:gj8fuxR21t5i8f9E4JeeREU4Uq+UFdisCApcpOOIneNZ:gj8fuK1GY9EYREf8Ufis7YOZeN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1696 1F82.tmp 2168 1FD0.tmp 3004 209B.tmp 1984 2137.tmp 2672 21C3.tmp 2604 2240.tmp 2092 22BD.tmp 2480 2349.tmp 2408 23E5.tmp 2448 2481.tmp 2524 24CF.tmp 2116 256B.tmp 2252 25C9.tmp 2920 2674.tmp 2968 2701.tmp 2064 278D.tmp 2268 281A.tmp 2420 28A6.tmp 2780 2904.tmp 2332 29A0.tmp 2784 29EE.tmp 2788 2A8A.tmp 1296 2B06.tmp 1188 2B54.tmp 1108 2BA2.tmp 2320 2BF0.tmp 2316 2C3E.tmp 2428 2C8C.tmp 472 2CDA.tmp 2856 2D19.tmp 2108 2D76.tmp 488 2DC4.tmp 680 2E12.tmp 1460 2E51.tmp 2176 2E8F.tmp 824 2ECE.tmp 1496 2F1C.tmp 1156 2F5A.tmp 1124 2FA8.tmp 2284 2FF6.tmp 1748 3044.tmp 2008 3082.tmp 1524 30D0.tmp 1584 311E.tmp 1004 316C.tmp 384 31BA.tmp 1740 3208.tmp 572 3266.tmp 2888 32B4.tmp 1980 32F2.tmp 312 3340.tmp 2344 337F.tmp 2352 33CD.tmp 608 340B.tmp 1688 3459.tmp 2356 3498.tmp 3008 34E6.tmp 1996 3524.tmp 1696 3562.tmp 2128 35B0.tmp 1596 35EF.tmp 2576 362D.tmp 2552 366C.tmp 2600 36AA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2356 2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe 1696 1F82.tmp 2168 1FD0.tmp 3004 209B.tmp 1984 2137.tmp 2672 21C3.tmp 2604 2240.tmp 2092 22BD.tmp 2480 2349.tmp 2408 23E5.tmp 2448 2481.tmp 2524 24CF.tmp 2116 256B.tmp 2252 25C9.tmp 2920 2674.tmp 2968 2701.tmp 2064 278D.tmp 2268 281A.tmp 2420 28A6.tmp 2780 2904.tmp 2332 29A0.tmp 2784 29EE.tmp 2788 2A8A.tmp 1296 2B06.tmp 1188 2B54.tmp 1108 2BA2.tmp 2320 2BF0.tmp 2316 2C3E.tmp 2428 2C8C.tmp 472 2CDA.tmp 2856 2D19.tmp 2108 2D76.tmp 488 2DC4.tmp 680 2E12.tmp 1460 2E51.tmp 2176 2E8F.tmp 824 2ECE.tmp 1496 2F1C.tmp 1156 2F5A.tmp 1124 2FA8.tmp 2284 2FF6.tmp 1748 3044.tmp 2008 3082.tmp 1524 30D0.tmp 1584 311E.tmp 1004 316C.tmp 384 31BA.tmp 1740 3208.tmp 572 3266.tmp 2888 32B4.tmp 1980 32F2.tmp 312 3340.tmp 2344 337F.tmp 2352 33CD.tmp 608 340B.tmp 1688 3459.tmp 2356 3498.tmp 3008 34E6.tmp 1996 3524.tmp 1696 3562.tmp 2128 35B0.tmp 1596 35EF.tmp 2576 362D.tmp 2552 366C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 1696 2356 2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe 28 PID 2356 wrote to memory of 1696 2356 2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe 28 PID 1696 wrote to memory of 2168 1696 1F82.tmp 29 PID 1696 wrote to memory of 2168 1696 1F82.tmp 29 PID 1696 wrote to memory of 2168 1696 1F82.tmp 29 PID 1696 wrote to memory of 2168 1696 1F82.tmp 29 PID 2168 wrote to memory of 3004 2168 1FD0.tmp 30 PID 2168 wrote to memory of 3004 2168 1FD0.tmp 30 PID 2168 wrote to memory of 3004 2168 1FD0.tmp 30 PID 2168 wrote to memory of 3004 2168 1FD0.tmp 30 PID 3004 wrote to memory of 1984 3004 209B.tmp 31 PID 3004 wrote to memory of 1984 3004 209B.tmp 31 PID 3004 wrote to memory of 1984 3004 209B.tmp 31 PID 3004 wrote to memory of 1984 3004 209B.tmp 31 PID 1984 wrote to memory of 2672 1984 2137.tmp 32 PID 1984 wrote to memory of 2672 1984 2137.tmp 32 PID 1984 wrote to memory of 2672 1984 2137.tmp 32 PID 1984 wrote to memory of 2672 1984 2137.tmp 32 PID 2672 wrote to memory of 2604 2672 21C3.tmp 33 PID 2672 wrote to memory of 2604 2672 21C3.tmp 33 PID 2672 wrote to memory of 2604 2672 21C3.tmp 33 PID 2672 wrote to memory of 2604 2672 21C3.tmp 33 PID 2604 wrote to memory of 2092 2604 2240.tmp 34 PID 2604 wrote to memory of 2092 2604 2240.tmp 34 PID 2604 wrote to memory of 2092 2604 2240.tmp 34 PID 2604 wrote to memory of 2092 2604 2240.tmp 34 PID 2092 wrote to memory of 2480 2092 22BD.tmp 35 PID 2092 wrote to memory of 2480 2092 22BD.tmp 35 PID 2092 wrote to memory of 2480 2092 22BD.tmp 35 PID 2092 wrote to memory of 2480 2092 22BD.tmp 35 PID 2480 wrote to memory of 2408 2480 2349.tmp 36 PID 2480 wrote to memory of 2408 2480 2349.tmp 36 PID 2480 wrote to memory of 2408 2480 2349.tmp 36 PID 2480 wrote to memory of 2408 2480 2349.tmp 36 PID 2408 wrote to memory of 2448 2408 23E5.tmp 37 PID 2408 wrote to memory of 2448 2408 23E5.tmp 37 PID 2408 wrote to memory of 2448 2408 23E5.tmp 37 PID 2408 wrote to memory of 2448 2408 23E5.tmp 37 PID 2448 wrote to memory of 2524 2448 2481.tmp 38 PID 2448 wrote to memory of 2524 2448 2481.tmp 38 PID 2448 wrote to memory of 2524 2448 2481.tmp 38 PID 2448 wrote to memory of 2524 2448 2481.tmp 38 PID 2524 wrote to memory of 2116 2524 24CF.tmp 39 PID 2524 wrote to memory of 2116 2524 24CF.tmp 39 PID 2524 wrote to memory of 2116 2524 24CF.tmp 39 PID 2524 wrote to memory of 2116 2524 24CF.tmp 39 PID 2116 wrote to memory of 2252 2116 256B.tmp 40 PID 2116 wrote to memory of 2252 2116 256B.tmp 40 PID 2116 wrote to memory of 2252 2116 256B.tmp 40 PID 2116 wrote to memory of 2252 2116 256B.tmp 40 PID 2252 wrote to memory of 2920 2252 25C9.tmp 41 PID 2252 wrote to memory of 2920 2252 25C9.tmp 41 PID 2252 wrote to memory of 2920 2252 25C9.tmp 41 PID 2252 wrote to memory of 2920 2252 25C9.tmp 41 PID 2920 wrote to memory of 2968 2920 2674.tmp 42 PID 2920 wrote to memory of 2968 2920 2674.tmp 42 PID 2920 wrote to memory of 2968 2920 2674.tmp 42 PID 2920 wrote to memory of 2968 2920 2674.tmp 42 PID 2968 wrote to memory of 2064 2968 2701.tmp 43 PID 2968 wrote to memory of 2064 2968 2701.tmp 43 PID 2968 wrote to memory of 2064 2968 2701.tmp 43 PID 2968 wrote to memory of 2064 2968 2701.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_b465a2cab42ba283330b7a0d9607bad3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"65⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"66⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"67⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"68⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"69⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"70⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"71⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"72⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"73⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"74⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"75⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"76⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"77⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"78⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"79⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"80⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"81⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"82⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"83⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"84⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"85⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"86⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"87⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"88⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"89⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"90⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"91⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"92⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"93⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"94⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"95⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"96⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"97⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"98⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"99⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"100⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"101⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"102⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"103⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"105⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"106⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"107⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"108⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"110⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"111⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"112⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"113⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"115⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"116⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"117⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"118⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"119⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"120⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"121⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-