Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe
-
Size
520KB
-
MD5
3f840108a0cdffa6fda3f6f837ddbd4e
-
SHA1
96e9c5c9f8ce0c2357833af9b66bdbc9bc6f5284
-
SHA256
0984f7ca5cfbc771f693361e1c05581ca3465dd6c04bd405c82eb4d7dd141e16
-
SHA512
843332ed5d73edb3cb1a4c12d04194d12e2076ba98bc1de55aaa02350a69d6e3c6db9898bf69691230b946edaa1a3e3f8913463df7e1e3990693b00943ab669d
-
SSDEEP
12288:roRXOQjmOyiEaZ5rztmYfV4O9AjHDY95lc2NZ:rogQ9yf8rZpt4OAjx2N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2276 5AC.tmp 2320 5FA.tmp 2896 667.tmp 1840 6B5.tmp 2532 722.tmp 2636 780.tmp 2788 7DD.tmp 2260 82B.tmp 2244 898.tmp 2664 8F6.tmp 2412 954.tmp 2496 9C1.tmp 2376 A2E.tmp 2204 A8C.tmp 2492 AE9.tmp 2760 B47.tmp 1608 BC4.tmp 1496 C12.tmp 1852 C7F.tmp 1260 CDC.tmp 2740 D4A.tmp 1744 DA7.tmp 1408 DF5.tmp 2120 E34.tmp 2520 E72.tmp 2124 EB0.tmp 2208 EEF.tmp 1984 F2D.tmp 1096 F6C.tmp 2016 FAA.tmp 268 FF8.tmp 1108 1036.tmp 1432 1075.tmp 1416 10B3.tmp 1016 1101.tmp 1952 1140.tmp 696 117E.tmp 1292 11BC.tmp 1648 11FB.tmp 2816 1239.tmp 2104 1278.tmp 1784 12B6.tmp 1240 12F4.tmp 1764 1333.tmp 1132 1371.tmp 1420 13B0.tmp 1308 13EE.tmp 3024 142C.tmp 2772 147A.tmp 3000 14C8.tmp 3060 1507.tmp 2380 1545.tmp 1732 1584.tmp 2036 15D2.tmp 1580 1610.tmp 1696 164E.tmp 1556 168D.tmp 2276 16CB.tmp 2888 170A.tmp 2852 1758.tmp 2944 1796.tmp 2116 17D4.tmp 2268 1813.tmp 2532 1851.tmp -
Loads dropped DLL 64 IoCs
pid Process 2344 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 2276 5AC.tmp 2320 5FA.tmp 2896 667.tmp 1840 6B5.tmp 2532 722.tmp 2636 780.tmp 2788 7DD.tmp 2260 82B.tmp 2244 898.tmp 2664 8F6.tmp 2412 954.tmp 2496 9C1.tmp 2376 A2E.tmp 2204 A8C.tmp 2492 AE9.tmp 2760 B47.tmp 1608 BC4.tmp 1496 C12.tmp 1852 C7F.tmp 1260 CDC.tmp 2740 D4A.tmp 1744 DA7.tmp 1408 DF5.tmp 2120 E34.tmp 2520 E72.tmp 2124 EB0.tmp 2208 EEF.tmp 1984 F2D.tmp 1096 F6C.tmp 2016 FAA.tmp 268 FF8.tmp 1108 1036.tmp 1432 1075.tmp 1416 10B3.tmp 1016 1101.tmp 1952 1140.tmp 696 117E.tmp 1292 11BC.tmp 1648 11FB.tmp 2816 1239.tmp 2104 1278.tmp 1784 12B6.tmp 1240 12F4.tmp 1764 1333.tmp 1132 1371.tmp 1420 13B0.tmp 1308 13EE.tmp 3024 142C.tmp 2772 147A.tmp 3000 14C8.tmp 3060 1507.tmp 2380 1545.tmp 1732 1584.tmp 2036 15D2.tmp 1580 1610.tmp 1696 164E.tmp 1556 168D.tmp 2276 16CB.tmp 2888 170A.tmp 2852 1758.tmp 2944 1796.tmp 2116 17D4.tmp 2268 1813.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2276 2344 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 28 PID 2344 wrote to memory of 2276 2344 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 28 PID 2344 wrote to memory of 2276 2344 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 28 PID 2344 wrote to memory of 2276 2344 2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe 28 PID 2276 wrote to memory of 2320 2276 5AC.tmp 29 PID 2276 wrote to memory of 2320 2276 5AC.tmp 29 PID 2276 wrote to memory of 2320 2276 5AC.tmp 29 PID 2276 wrote to memory of 2320 2276 5AC.tmp 29 PID 2320 wrote to memory of 2896 2320 5FA.tmp 30 PID 2320 wrote to memory of 2896 2320 5FA.tmp 30 PID 2320 wrote to memory of 2896 2320 5FA.tmp 30 PID 2320 wrote to memory of 2896 2320 5FA.tmp 30 PID 2896 wrote to memory of 1840 2896 667.tmp 31 PID 2896 wrote to memory of 1840 2896 667.tmp 31 PID 2896 wrote to memory of 1840 2896 667.tmp 31 PID 2896 wrote to memory of 1840 2896 667.tmp 31 PID 1840 wrote to memory of 2532 1840 6B5.tmp 32 PID 1840 wrote to memory of 2532 1840 6B5.tmp 32 PID 1840 wrote to memory of 2532 1840 6B5.tmp 32 PID 1840 wrote to memory of 2532 1840 6B5.tmp 32 PID 2532 wrote to memory of 2636 2532 722.tmp 33 PID 2532 wrote to memory of 2636 2532 722.tmp 33 PID 2532 wrote to memory of 2636 2532 722.tmp 33 PID 2532 wrote to memory of 2636 2532 722.tmp 33 PID 2636 wrote to memory of 2788 2636 780.tmp 34 PID 2636 wrote to memory of 2788 2636 780.tmp 34 PID 2636 wrote to memory of 2788 2636 780.tmp 34 PID 2636 wrote to memory of 2788 2636 780.tmp 34 PID 2788 wrote to memory of 2260 2788 7DD.tmp 35 PID 2788 wrote to memory of 2260 2788 7DD.tmp 35 PID 2788 wrote to memory of 2260 2788 7DD.tmp 35 PID 2788 wrote to memory of 2260 2788 7DD.tmp 35 PID 2260 wrote to memory of 2244 2260 82B.tmp 36 PID 2260 wrote to memory of 2244 2260 82B.tmp 36 PID 2260 wrote to memory of 2244 2260 82B.tmp 36 PID 2260 wrote to memory of 2244 2260 82B.tmp 36 PID 2244 wrote to memory of 2664 2244 898.tmp 37 PID 2244 wrote to memory of 2664 2244 898.tmp 37 PID 2244 wrote to memory of 2664 2244 898.tmp 37 PID 2244 wrote to memory of 2664 2244 898.tmp 37 PID 2664 wrote to memory of 2412 2664 8F6.tmp 38 PID 2664 wrote to memory of 2412 2664 8F6.tmp 38 PID 2664 wrote to memory of 2412 2664 8F6.tmp 38 PID 2664 wrote to memory of 2412 2664 8F6.tmp 38 PID 2412 wrote to memory of 2496 2412 954.tmp 39 PID 2412 wrote to memory of 2496 2412 954.tmp 39 PID 2412 wrote to memory of 2496 2412 954.tmp 39 PID 2412 wrote to memory of 2496 2412 954.tmp 39 PID 2496 wrote to memory of 2376 2496 9C1.tmp 40 PID 2496 wrote to memory of 2376 2496 9C1.tmp 40 PID 2496 wrote to memory of 2376 2496 9C1.tmp 40 PID 2496 wrote to memory of 2376 2496 9C1.tmp 40 PID 2376 wrote to memory of 2204 2376 A2E.tmp 41 PID 2376 wrote to memory of 2204 2376 A2E.tmp 41 PID 2376 wrote to memory of 2204 2376 A2E.tmp 41 PID 2376 wrote to memory of 2204 2376 A2E.tmp 41 PID 2204 wrote to memory of 2492 2204 A8C.tmp 42 PID 2204 wrote to memory of 2492 2204 A8C.tmp 42 PID 2204 wrote to memory of 2492 2204 A8C.tmp 42 PID 2204 wrote to memory of 2492 2204 A8C.tmp 42 PID 2492 wrote to memory of 2760 2492 AE9.tmp 43 PID 2492 wrote to memory of 2760 2492 AE9.tmp 43 PID 2492 wrote to memory of 2760 2492 AE9.tmp 43 PID 2492 wrote to memory of 2760 2492 AE9.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_3f840108a0cdffa6fda3f6f837ddbd4e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\82B.tmp"C:\Users\Admin\AppData\Local\Temp\82B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8F6.tmp"C:\Users\Admin\AppData\Local\Temp\8F6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\AE9.tmp"C:\Users\Admin\AppData\Local\Temp\AE9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\BC4.tmp"C:\Users\Admin\AppData\Local\Temp\BC4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"65⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"66⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"67⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"69⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"70⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"71⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"72⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"73⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"74⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"76⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"77⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"78⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"79⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"80⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"81⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"82⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"83⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"84⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"85⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"86⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"87⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"88⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"89⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"90⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"91⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"92⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"93⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"94⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"95⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"97⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"98⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"99⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"100⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"101⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"102⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"103⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"104⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"105⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"106⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"107⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"108⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"109⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"110⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"111⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"112⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"113⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"114⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"115⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"116⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"117⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"118⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"119⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"120⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"121⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-