Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 07:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe
-
Size
530KB
-
MD5
f3ad8bbac1f782a598e2ba4fc3a2efd7
-
SHA1
b7490a23044b5b3d9969baba5c69bf3b02e676e4
-
SHA256
7623664fcb5cdfe8ddc98aaf747525056362c75637fbb4a09a5ded58022fc2f3
-
SHA512
c7064f5ff9102c645e3ae1349ac620cbfd921398ae54e39610a7ff2203bdbdc11169a1ceed9917f4aed0db66a488e772e818f438e27921a72740f894c445f52e
-
SSDEEP
12288:AU5rCOTeioKRLakAd6TNN5+onCe4Hvx6gUbNZulFVg0M1:AUQOJoKRBAGNN574Px6ggNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3036 F1E.tmp 2396 F6C.tmp 2144 FAA.tmp 2304 FE8.tmp 2712 1027.tmp 2792 1075.tmp 3008 10D2.tmp 2644 1120.tmp 2612 117E.tmp 2444 11DC.tmp 2500 122A.tmp 2936 1278.tmp 1944 12B6.tmp 2632 12F4.tmp 2752 1342.tmp 2820 1381.tmp 1996 13BF.tmp 1136 13FE.tmp 376 144C.tmp 1060 149A.tmp 1952 14D8.tmp 1964 1526.tmp 1688 1574.tmp 1540 15E1.tmp 1744 1620.tmp 1740 166E.tmp 1256 16AC.tmp 2280 16EA.tmp 632 1729.tmp 1916 1767.tmp 2204 17A6.tmp 268 17E4.tmp 1488 1822.tmp 1484 1861.tmp 848 1890.tmp 1788 18CE.tmp 1380 190C.tmp 1908 194B.tmp 2488 1989.tmp 2088 19B8.tmp 280 19F6.tmp 1764 1A35.tmp 1864 1A73.tmp 640 1AB2.tmp 2084 1B00.tmp 1804 1B3E.tmp 944 1B7C.tmp 2404 1BBB.tmp 836 1BF9.tmp 1524 1C38.tmp 2056 1C76.tmp 1700 1CB4.tmp 1512 1CF3.tmp 320 1D31.tmp 2960 1D70.tmp 2360 1DAE.tmp 1940 1DEC.tmp 1312 1E2B.tmp 2996 1E69.tmp 2556 1EA8.tmp 1172 1ED6.tmp 2720 1F15.tmp 2804 1F53.tmp 2792 1F92.tmp -
Loads dropped DLL 64 IoCs
pid Process 1948 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 3036 F1E.tmp 2396 F6C.tmp 2144 FAA.tmp 2304 FE8.tmp 2712 1027.tmp 2792 1075.tmp 3008 10D2.tmp 2644 1120.tmp 2612 117E.tmp 2444 11DC.tmp 2500 122A.tmp 2936 1278.tmp 1944 12B6.tmp 2632 12F4.tmp 2752 1342.tmp 2820 1381.tmp 1996 13BF.tmp 1136 13FE.tmp 376 144C.tmp 1060 149A.tmp 1952 14D8.tmp 1964 1526.tmp 1688 1574.tmp 1540 15E1.tmp 1744 1620.tmp 1740 166E.tmp 1256 16AC.tmp 2280 16EA.tmp 632 1729.tmp 1916 1767.tmp 2204 17A6.tmp 268 17E4.tmp 1488 1822.tmp 1484 1861.tmp 848 1890.tmp 1788 18CE.tmp 1380 190C.tmp 1908 194B.tmp 2488 1989.tmp 2088 19B8.tmp 280 19F6.tmp 1764 1A35.tmp 1864 1A73.tmp 640 1AB2.tmp 2084 1B00.tmp 1804 1B3E.tmp 944 1B7C.tmp 2404 1BBB.tmp 836 1BF9.tmp 1524 1C38.tmp 2056 1C76.tmp 1700 1CB4.tmp 1512 1CF3.tmp 320 1D31.tmp 2960 1D70.tmp 2360 1DAE.tmp 1940 1DEC.tmp 1312 1E2B.tmp 2996 1E69.tmp 2556 1EA8.tmp 1172 1ED6.tmp 2720 1F15.tmp 2804 1F53.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 3036 1948 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 28 PID 1948 wrote to memory of 3036 1948 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 28 PID 1948 wrote to memory of 3036 1948 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 28 PID 1948 wrote to memory of 3036 1948 2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe 28 PID 3036 wrote to memory of 2396 3036 F1E.tmp 29 PID 3036 wrote to memory of 2396 3036 F1E.tmp 29 PID 3036 wrote to memory of 2396 3036 F1E.tmp 29 PID 3036 wrote to memory of 2396 3036 F1E.tmp 29 PID 2396 wrote to memory of 2144 2396 F6C.tmp 30 PID 2396 wrote to memory of 2144 2396 F6C.tmp 30 PID 2396 wrote to memory of 2144 2396 F6C.tmp 30 PID 2396 wrote to memory of 2144 2396 F6C.tmp 30 PID 2144 wrote to memory of 2304 2144 FAA.tmp 31 PID 2144 wrote to memory of 2304 2144 FAA.tmp 31 PID 2144 wrote to memory of 2304 2144 FAA.tmp 31 PID 2144 wrote to memory of 2304 2144 FAA.tmp 31 PID 2304 wrote to memory of 2712 2304 FE8.tmp 32 PID 2304 wrote to memory of 2712 2304 FE8.tmp 32 PID 2304 wrote to memory of 2712 2304 FE8.tmp 32 PID 2304 wrote to memory of 2712 2304 FE8.tmp 32 PID 2712 wrote to memory of 2792 2712 1027.tmp 33 PID 2712 wrote to memory of 2792 2712 1027.tmp 33 PID 2712 wrote to memory of 2792 2712 1027.tmp 33 PID 2712 wrote to memory of 2792 2712 1027.tmp 33 PID 2792 wrote to memory of 3008 2792 1075.tmp 34 PID 2792 wrote to memory of 3008 2792 1075.tmp 34 PID 2792 wrote to memory of 3008 2792 1075.tmp 34 PID 2792 wrote to memory of 3008 2792 1075.tmp 34 PID 3008 wrote to memory of 2644 3008 10D2.tmp 35 PID 3008 wrote to memory of 2644 3008 10D2.tmp 35 PID 3008 wrote to memory of 2644 3008 10D2.tmp 35 PID 3008 wrote to memory of 2644 3008 10D2.tmp 35 PID 2644 wrote to memory of 2612 2644 1120.tmp 36 PID 2644 wrote to memory of 2612 2644 1120.tmp 36 PID 2644 wrote to memory of 2612 2644 1120.tmp 36 PID 2644 wrote to memory of 2612 2644 1120.tmp 36 PID 2612 wrote to memory of 2444 2612 117E.tmp 37 PID 2612 wrote to memory of 2444 2612 117E.tmp 37 PID 2612 wrote to memory of 2444 2612 117E.tmp 37 PID 2612 wrote to memory of 2444 2612 117E.tmp 37 PID 2444 wrote to memory of 2500 2444 11DC.tmp 38 PID 2444 wrote to memory of 2500 2444 11DC.tmp 38 PID 2444 wrote to memory of 2500 2444 11DC.tmp 38 PID 2444 wrote to memory of 2500 2444 11DC.tmp 38 PID 2500 wrote to memory of 2936 2500 122A.tmp 39 PID 2500 wrote to memory of 2936 2500 122A.tmp 39 PID 2500 wrote to memory of 2936 2500 122A.tmp 39 PID 2500 wrote to memory of 2936 2500 122A.tmp 39 PID 2936 wrote to memory of 1944 2936 1278.tmp 40 PID 2936 wrote to memory of 1944 2936 1278.tmp 40 PID 2936 wrote to memory of 1944 2936 1278.tmp 40 PID 2936 wrote to memory of 1944 2936 1278.tmp 40 PID 1944 wrote to memory of 2632 1944 12B6.tmp 41 PID 1944 wrote to memory of 2632 1944 12B6.tmp 41 PID 1944 wrote to memory of 2632 1944 12B6.tmp 41 PID 1944 wrote to memory of 2632 1944 12B6.tmp 41 PID 2632 wrote to memory of 2752 2632 12F4.tmp 42 PID 2632 wrote to memory of 2752 2632 12F4.tmp 42 PID 2632 wrote to memory of 2752 2632 12F4.tmp 42 PID 2632 wrote to memory of 2752 2632 12F4.tmp 42 PID 2752 wrote to memory of 2820 2752 1342.tmp 43 PID 2752 wrote to memory of 2820 2752 1342.tmp 43 PID 2752 wrote to memory of 2820 2752 1342.tmp 43 PID 2752 wrote to memory of 2820 2752 1342.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_f3ad8bbac1f782a598e2ba4fc3a2efd7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"65⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"66⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"67⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"68⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"69⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"70⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"71⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"72⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"73⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"74⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"75⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"76⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"77⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"78⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"79⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"80⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"81⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"82⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"83⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"84⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"86⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"87⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"88⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"89⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"90⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"91⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"92⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"93⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"94⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"95⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"96⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"97⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"98⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"99⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"100⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"101⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"102⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"103⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"104⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"105⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"106⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"107⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"108⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"109⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"110⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"111⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"112⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"113⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"114⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"115⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"116⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"117⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"118⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"119⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"120⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"121⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-