Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 19:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe
-
Size
520KB
-
MD5
100cc81bf7e71e892398ea04cc0961b1
-
SHA1
5f078c4b9f16cfdcdd639480c6ed74143c192b3f
-
SHA256
f91ba608bf8d486c2649e84c006677fb3e8f2b438b56d6e774b0f1599e0f79cd
-
SHA512
f88feb931f1f6060dc1b0448a5417f8cbd9301f7b72d35f666181bba1631faf00188b72276388bdaece43a43cb59d97dc203c1a95bb05a121aa9c4db4628fdf3
-
SSDEEP
12288:gj8fuxR21t5i8fOnkfv37qPAPhpl8fDrLNZ:gj8fuK1GYOyv3GPIeDHN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2320 F3D.tmp 1712 F9A.tmp 2256 1008.tmp 2688 1075.tmp 2564 10D2.tmp 2280 1140.tmp 2652 119D.tmp 2484 120A.tmp 2516 1287.tmp 2524 12E5.tmp 2908 1352.tmp 2928 13BF.tmp 2436 143C.tmp 2752 14A9.tmp 2792 1516.tmp 1668 15A3.tmp 2012 1610.tmp 1284 167D.tmp 320 16DB.tmp 1052 1738.tmp 816 1796.tmp 1648 1803.tmp 1696 1861.tmp 1772 18AF.tmp 2312 18FD.tmp 2068 193B.tmp 2804 1999.tmp 2968 19D7.tmp 2848 1A16.tmp 2096 1A54.tmp 604 1A92.tmp 832 1AE0.tmp 1492 1B2E.tmp 3020 1B6D.tmp 868 1BBB.tmp 848 1C09.tmp 624 1C57.tmp 452 1CA5.tmp 2168 1CF3.tmp 2152 1D41.tmp 1396 1D7F.tmp 1792 1DBE.tmp 1372 1E0C.tmp 1932 1E5A.tmp 2844 1EA8.tmp 276 1EF6.tmp 708 1F34.tmp 2324 1F92.tmp 1964 1FE0.tmp 360 201E.tmp 1928 205C.tmp 1448 209B.tmp 2056 20E9.tmp 2212 2137.tmp 1592 2185.tmp 1616 21D3.tmp 1460 2211.tmp 2320 225F.tmp 2608 22AD.tmp 2604 230B.tmp 2256 2359.tmp 3044 2397.tmp 3004 23E5.tmp 2824 2424.tmp -
Loads dropped DLL 64 IoCs
pid Process 2112 2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe 2320 F3D.tmp 1712 F9A.tmp 2256 1008.tmp 2688 1075.tmp 2564 10D2.tmp 2280 1140.tmp 2652 119D.tmp 2484 120A.tmp 2516 1287.tmp 2524 12E5.tmp 2908 1352.tmp 2928 13BF.tmp 2436 143C.tmp 2752 14A9.tmp 2792 1516.tmp 1668 15A3.tmp 2012 1610.tmp 1284 167D.tmp 320 16DB.tmp 1052 1738.tmp 816 1796.tmp 1648 1803.tmp 1696 1861.tmp 1772 18AF.tmp 2312 18FD.tmp 2068 193B.tmp 2804 1999.tmp 2968 19D7.tmp 2848 1A16.tmp 2096 1A54.tmp 604 1A92.tmp 832 1AE0.tmp 1492 1B2E.tmp 3020 1B6D.tmp 868 1BBB.tmp 848 1C09.tmp 624 1C57.tmp 452 1CA5.tmp 2168 1CF3.tmp 2152 1D41.tmp 1396 1D7F.tmp 1792 1DBE.tmp 1372 1E0C.tmp 1932 1E5A.tmp 2844 1EA8.tmp 276 1EF6.tmp 708 1F34.tmp 2324 1F92.tmp 1964 1FE0.tmp 360 201E.tmp 1928 205C.tmp 1448 209B.tmp 2056 20E9.tmp 2212 2137.tmp 1592 2185.tmp 1616 21D3.tmp 1460 2211.tmp 2320 225F.tmp 2608 22AD.tmp 2604 230B.tmp 2256 2359.tmp 3044 2397.tmp 3004 23E5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2320 2112 2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe 28 PID 2112 wrote to memory of 2320 2112 2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe 28 PID 2112 wrote to memory of 2320 2112 2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe 28 PID 2112 wrote to memory of 2320 2112 2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe 28 PID 2320 wrote to memory of 1712 2320 F3D.tmp 29 PID 2320 wrote to memory of 1712 2320 F3D.tmp 29 PID 2320 wrote to memory of 1712 2320 F3D.tmp 29 PID 2320 wrote to memory of 1712 2320 F3D.tmp 29 PID 1712 wrote to memory of 2256 1712 F9A.tmp 30 PID 1712 wrote to memory of 2256 1712 F9A.tmp 30 PID 1712 wrote to memory of 2256 1712 F9A.tmp 30 PID 1712 wrote to memory of 2256 1712 F9A.tmp 30 PID 2256 wrote to memory of 2688 2256 1008.tmp 31 PID 2256 wrote to memory of 2688 2256 1008.tmp 31 PID 2256 wrote to memory of 2688 2256 1008.tmp 31 PID 2256 wrote to memory of 2688 2256 1008.tmp 31 PID 2688 wrote to memory of 2564 2688 1075.tmp 32 PID 2688 wrote to memory of 2564 2688 1075.tmp 32 PID 2688 wrote to memory of 2564 2688 1075.tmp 32 PID 2688 wrote to memory of 2564 2688 1075.tmp 32 PID 2564 wrote to memory of 2280 2564 10D2.tmp 33 PID 2564 wrote to memory of 2280 2564 10D2.tmp 33 PID 2564 wrote to memory of 2280 2564 10D2.tmp 33 PID 2564 wrote to memory of 2280 2564 10D2.tmp 33 PID 2280 wrote to memory of 2652 2280 1140.tmp 34 PID 2280 wrote to memory of 2652 2280 1140.tmp 34 PID 2280 wrote to memory of 2652 2280 1140.tmp 34 PID 2280 wrote to memory of 2652 2280 1140.tmp 34 PID 2652 wrote to memory of 2484 2652 119D.tmp 35 PID 2652 wrote to memory of 2484 2652 119D.tmp 35 PID 2652 wrote to memory of 2484 2652 119D.tmp 35 PID 2652 wrote to memory of 2484 2652 119D.tmp 35 PID 2484 wrote to memory of 2516 2484 120A.tmp 36 PID 2484 wrote to memory of 2516 2484 120A.tmp 36 PID 2484 wrote to memory of 2516 2484 120A.tmp 36 PID 2484 wrote to memory of 2516 2484 120A.tmp 36 PID 2516 wrote to memory of 2524 2516 1287.tmp 37 PID 2516 wrote to memory of 2524 2516 1287.tmp 37 PID 2516 wrote to memory of 2524 2516 1287.tmp 37 PID 2516 wrote to memory of 2524 2516 1287.tmp 37 PID 2524 wrote to memory of 2908 2524 12E5.tmp 38 PID 2524 wrote to memory of 2908 2524 12E5.tmp 38 PID 2524 wrote to memory of 2908 2524 12E5.tmp 38 PID 2524 wrote to memory of 2908 2524 12E5.tmp 38 PID 2908 wrote to memory of 2928 2908 1352.tmp 39 PID 2908 wrote to memory of 2928 2908 1352.tmp 39 PID 2908 wrote to memory of 2928 2908 1352.tmp 39 PID 2908 wrote to memory of 2928 2908 1352.tmp 39 PID 2928 wrote to memory of 2436 2928 13BF.tmp 40 PID 2928 wrote to memory of 2436 2928 13BF.tmp 40 PID 2928 wrote to memory of 2436 2928 13BF.tmp 40 PID 2928 wrote to memory of 2436 2928 13BF.tmp 40 PID 2436 wrote to memory of 2752 2436 143C.tmp 41 PID 2436 wrote to memory of 2752 2436 143C.tmp 41 PID 2436 wrote to memory of 2752 2436 143C.tmp 41 PID 2436 wrote to memory of 2752 2436 143C.tmp 41 PID 2752 wrote to memory of 2792 2752 14A9.tmp 42 PID 2752 wrote to memory of 2792 2752 14A9.tmp 42 PID 2752 wrote to memory of 2792 2752 14A9.tmp 42 PID 2752 wrote to memory of 2792 2752 14A9.tmp 42 PID 2792 wrote to memory of 1668 2792 1516.tmp 43 PID 2792 wrote to memory of 1668 2792 1516.tmp 43 PID 2792 wrote to memory of 1668 2792 1516.tmp 43 PID 2792 wrote to memory of 1668 2792 1516.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_100cc81bf7e71e892398ea04cc0961b1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:452 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"65⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"67⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"69⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"70⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"71⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"72⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"73⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"74⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"75⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"76⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"77⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"78⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"79⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"80⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"82⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"83⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"84⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"85⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"86⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"87⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"88⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"89⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"90⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"91⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"92⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"93⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"94⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"95⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"96⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"97⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"98⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"99⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"100⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"101⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"102⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"103⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"104⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"105⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"106⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"107⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"108⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"109⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"110⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"111⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"112⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"113⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"114⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"115⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"116⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"117⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"118⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"119⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"120⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"121⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"122⤵PID:1968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-