Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
04/06/2024, 16:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe
-
Size
487KB
-
MD5
d74ffb1af9863b11a2161458dde72799
-
SHA1
afcdb2681ebed00860ecfb79ec81140cb86eeedc
-
SHA256
5a770fef3f18314193c50d554b506504789903d3612bc610f9b54b9c0b1942c1
-
SHA512
69dda4be515bb406eec3c057f63bffe1daa421e68f1541bf2acf219fc5f5a5d869b6779ee613d965ab71fdcdfeabe2d71c680dbabbfcbaf17ea76aab12ec11e0
-
SSDEEP
12288:HU5rCOTeiJaehqhVIpZPI8YkINHzAwANZ:HUQOJJaeshVIhPxINHIN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2652 14A9.tmp 2344 1516.tmp 2684 15A3.tmp 2624 1610.tmp 2588 165E.tmp 2492 16BC.tmp 2772 16FA.tmp 2468 1767.tmp 2548 17E4.tmp 2528 1851.tmp 2156 1890.tmp 1144 190C.tmp 1248 197A.tmp 2540 19D7.tmp 1028 1A44.tmp 1544 1AB2.tmp 868 1B2E.tmp 2184 1B9C.tmp 2716 1C18.tmp 2404 1C86.tmp 2724 1CD4.tmp 2796 1D31.tmp 2812 1D8F.tmp 2756 1DDD.tmp 2208 1E2B.tmp 1832 1E69.tmp 2216 1EA8.tmp 2508 1EF6.tmp 784 1F44.tmp 572 1F82.tmp 1404 1FD0.tmp 1668 200E.tmp 1748 205C.tmp 2436 209B.tmp 2120 20D9.tmp 2052 2118.tmp 1136 2156.tmp 3020 2194.tmp 876 21E2.tmp 2868 2221.tmp 324 225F.tmp 1788 229E.tmp 1656 22EC.tmp 1496 232A.tmp 2296 2368.tmp 2852 23A7.tmp 2264 23E5.tmp 2220 2424.tmp 2736 2462.tmp 988 24A0.tmp 2880 24EE.tmp 3044 252D.tmp 1424 256B.tmp 2964 25AA.tmp 3004 25F8.tmp 1528 2636.tmp 3016 2674.tmp 2652 26B3.tmp 2580 2701.tmp 2708 273F.tmp 2672 278D.tmp 2476 27CC.tmp 2624 280A.tmp 2828 2848.tmp -
Loads dropped DLL 64 IoCs
pid Process 1580 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 2652 14A9.tmp 2344 1516.tmp 2684 15A3.tmp 2624 1610.tmp 2588 165E.tmp 2492 16BC.tmp 2772 16FA.tmp 2468 1767.tmp 2548 17E4.tmp 2528 1851.tmp 2156 1890.tmp 1144 190C.tmp 1248 197A.tmp 2540 19D7.tmp 1028 1A44.tmp 1544 1AB2.tmp 868 1B2E.tmp 2184 1B9C.tmp 2716 1C18.tmp 2404 1C86.tmp 2724 1CD4.tmp 2796 1D31.tmp 2812 1D8F.tmp 2756 1DDD.tmp 2208 1E2B.tmp 1832 1E69.tmp 2216 1EA8.tmp 2508 1EF6.tmp 784 1F44.tmp 572 1F82.tmp 1404 1FD0.tmp 1668 200E.tmp 1748 205C.tmp 2436 209B.tmp 2120 20D9.tmp 2052 2118.tmp 1136 2156.tmp 3020 2194.tmp 876 21E2.tmp 2868 2221.tmp 324 225F.tmp 1788 229E.tmp 1656 22EC.tmp 1496 232A.tmp 2296 2368.tmp 2852 23A7.tmp 2264 23E5.tmp 2220 2424.tmp 2736 2462.tmp 988 24A0.tmp 2880 24EE.tmp 3044 252D.tmp 1424 256B.tmp 2964 25AA.tmp 3004 25F8.tmp 1528 2636.tmp 3016 2674.tmp 2652 26B3.tmp 2580 2701.tmp 2708 273F.tmp 2672 278D.tmp 2476 27CC.tmp 2624 280A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2652 1580 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 28 PID 1580 wrote to memory of 2652 1580 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 28 PID 1580 wrote to memory of 2652 1580 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 28 PID 1580 wrote to memory of 2652 1580 2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe 28 PID 2652 wrote to memory of 2344 2652 14A9.tmp 29 PID 2652 wrote to memory of 2344 2652 14A9.tmp 29 PID 2652 wrote to memory of 2344 2652 14A9.tmp 29 PID 2652 wrote to memory of 2344 2652 14A9.tmp 29 PID 2344 wrote to memory of 2684 2344 1516.tmp 30 PID 2344 wrote to memory of 2684 2344 1516.tmp 30 PID 2344 wrote to memory of 2684 2344 1516.tmp 30 PID 2344 wrote to memory of 2684 2344 1516.tmp 30 PID 2684 wrote to memory of 2624 2684 15A3.tmp 31 PID 2684 wrote to memory of 2624 2684 15A3.tmp 31 PID 2684 wrote to memory of 2624 2684 15A3.tmp 31 PID 2684 wrote to memory of 2624 2684 15A3.tmp 31 PID 2624 wrote to memory of 2588 2624 1610.tmp 32 PID 2624 wrote to memory of 2588 2624 1610.tmp 32 PID 2624 wrote to memory of 2588 2624 1610.tmp 32 PID 2624 wrote to memory of 2588 2624 1610.tmp 32 PID 2588 wrote to memory of 2492 2588 165E.tmp 33 PID 2588 wrote to memory of 2492 2588 165E.tmp 33 PID 2588 wrote to memory of 2492 2588 165E.tmp 33 PID 2588 wrote to memory of 2492 2588 165E.tmp 33 PID 2492 wrote to memory of 2772 2492 16BC.tmp 34 PID 2492 wrote to memory of 2772 2492 16BC.tmp 34 PID 2492 wrote to memory of 2772 2492 16BC.tmp 34 PID 2492 wrote to memory of 2772 2492 16BC.tmp 34 PID 2772 wrote to memory of 2468 2772 16FA.tmp 35 PID 2772 wrote to memory of 2468 2772 16FA.tmp 35 PID 2772 wrote to memory of 2468 2772 16FA.tmp 35 PID 2772 wrote to memory of 2468 2772 16FA.tmp 35 PID 2468 wrote to memory of 2548 2468 1767.tmp 36 PID 2468 wrote to memory of 2548 2468 1767.tmp 36 PID 2468 wrote to memory of 2548 2468 1767.tmp 36 PID 2468 wrote to memory of 2548 2468 1767.tmp 36 PID 2548 wrote to memory of 2528 2548 17E4.tmp 37 PID 2548 wrote to memory of 2528 2548 17E4.tmp 37 PID 2548 wrote to memory of 2528 2548 17E4.tmp 37 PID 2548 wrote to memory of 2528 2548 17E4.tmp 37 PID 2528 wrote to memory of 2156 2528 1851.tmp 38 PID 2528 wrote to memory of 2156 2528 1851.tmp 38 PID 2528 wrote to memory of 2156 2528 1851.tmp 38 PID 2528 wrote to memory of 2156 2528 1851.tmp 38 PID 2156 wrote to memory of 1144 2156 1890.tmp 39 PID 2156 wrote to memory of 1144 2156 1890.tmp 39 PID 2156 wrote to memory of 1144 2156 1890.tmp 39 PID 2156 wrote to memory of 1144 2156 1890.tmp 39 PID 1144 wrote to memory of 1248 1144 190C.tmp 40 PID 1144 wrote to memory of 1248 1144 190C.tmp 40 PID 1144 wrote to memory of 1248 1144 190C.tmp 40 PID 1144 wrote to memory of 1248 1144 190C.tmp 40 PID 1248 wrote to memory of 2540 1248 197A.tmp 41 PID 1248 wrote to memory of 2540 1248 197A.tmp 41 PID 1248 wrote to memory of 2540 1248 197A.tmp 41 PID 1248 wrote to memory of 2540 1248 197A.tmp 41 PID 2540 wrote to memory of 1028 2540 19D7.tmp 42 PID 2540 wrote to memory of 1028 2540 19D7.tmp 42 PID 2540 wrote to memory of 1028 2540 19D7.tmp 42 PID 2540 wrote to memory of 1028 2540 19D7.tmp 42 PID 1028 wrote to memory of 1544 1028 1A44.tmp 43 PID 1028 wrote to memory of 1544 1028 1A44.tmp 43 PID 1028 wrote to memory of 1544 1028 1A44.tmp 43 PID 1028 wrote to memory of 1544 1028 1A44.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_d74ffb1af9863b11a2161458dde72799_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"65⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"66⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"67⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"68⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"69⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"70⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"71⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"72⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"73⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"74⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"75⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"76⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"77⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"79⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"80⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"81⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"82⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"83⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"84⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"85⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"86⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"87⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"88⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"89⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"90⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"91⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"92⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"93⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"94⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"95⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"96⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"97⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"98⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"99⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"100⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"101⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"102⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"103⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"104⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"105⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"106⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"107⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"108⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"109⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"110⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"111⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"112⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"113⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"114⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"115⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"116⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"117⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"118⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"119⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"120⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"121⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"122⤵PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-