Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe
-
Size
520KB
-
MD5
c220c354646de36d9762158e9391b1e1
-
SHA1
aed29929663fd37c6d24a10c9fe4b85d970f7215
-
SHA256
5956d54244197fc341dd96f41ed300548f0827657027f3633df6da851bd859ed
-
SHA512
57b8ebffeea75e4c1b6d44088d29b7b76f5e3676d4f7fccefa1b3d7f4c2a52727aa744983869fad34e7552e980d2332c71e478adb6d10791bcdaa68ad1ad5119
-
SSDEEP
12288:roRXOQjmOyIwckp3JEm7XhO/ziSSZJK32GNZ:rogQ9yIwDp3JEm7MriSuK32GN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2408 1027.tmp 2820 1056.tmp 2172 10E2.tmp 2556 1120.tmp 2672 116E.tmp 2616 11AD.tmp 3024 120A.tmp 2800 1258.tmp 2652 12A6.tmp 2520 12F4.tmp 2516 1333.tmp 2756 1371.tmp 2412 13BF.tmp 1788 13FE.tmp 2648 143C.tmp 1672 148A.tmp 1364 14C8.tmp 1640 1507.tmp 2524 1545.tmp 2908 1593.tmp 1860 15E1.tmp 1864 1620.tmp 1792 165E.tmp 2560 169C.tmp 2960 16EA.tmp 2344 1738.tmp 2276 1777.tmp 2056 17C5.tmp 1604 17F4.tmp 608 1822.tmp 488 1861.tmp 380 1890.tmp 1216 18CE.tmp 848 190C.tmp 1984 194B.tmp 1848 1989.tmp 448 19C8.tmp 1268 1A06.tmp 2840 1A44.tmp 888 1A83.tmp 1568 1AC1.tmp 992 1B00.tmp 632 1B3E.tmp 3052 1B7C.tmp 1068 1BBB.tmp 972 1BF9.tmp 2212 1C38.tmp 1964 1C76.tmp 1104 1CB4.tmp 2340 1CF3.tmp 1284 1D31.tmp 1768 1D70.tmp 1824 1DBE.tmp 2364 1DFC.tmp 2372 1E3A.tmp 1624 1E79.tmp 2780 1EB7.tmp 2408 1EF6.tmp 3056 1F34.tmp 3032 1F72.tmp 2664 1FB1.tmp 1360 1FEF.tmp 2672 201E.tmp 2656 205C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2240 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 2408 1027.tmp 2820 1056.tmp 2172 10E2.tmp 2556 1120.tmp 2672 116E.tmp 2616 11AD.tmp 3024 120A.tmp 2800 1258.tmp 2652 12A6.tmp 2520 12F4.tmp 2516 1333.tmp 2756 1371.tmp 2412 13BF.tmp 1788 13FE.tmp 2648 143C.tmp 1672 148A.tmp 1364 14C8.tmp 1640 1507.tmp 2524 1545.tmp 2908 1593.tmp 1860 15E1.tmp 1864 1620.tmp 1792 165E.tmp 2560 169C.tmp 2960 16EA.tmp 2344 1738.tmp 2276 1777.tmp 2056 17C5.tmp 1604 17F4.tmp 608 1822.tmp 488 1861.tmp 380 1890.tmp 1216 18CE.tmp 848 190C.tmp 1984 194B.tmp 1848 1989.tmp 448 19C8.tmp 1268 1A06.tmp 2840 1A44.tmp 888 1A83.tmp 1568 1AC1.tmp 992 1B00.tmp 632 1B3E.tmp 3052 1B7C.tmp 1068 1BBB.tmp 972 1BF9.tmp 2212 1C38.tmp 1964 1C76.tmp 1104 1CB4.tmp 2340 1CF3.tmp 1284 1D31.tmp 1768 1D70.tmp 1824 1DBE.tmp 2364 1DFC.tmp 2372 1E3A.tmp 1624 1E79.tmp 2780 1EB7.tmp 2408 1EF6.tmp 3056 1F34.tmp 3032 1F72.tmp 2664 1FB1.tmp 1360 1FEF.tmp 2672 201E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2408 2240 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 28 PID 2240 wrote to memory of 2408 2240 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 28 PID 2240 wrote to memory of 2408 2240 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 28 PID 2240 wrote to memory of 2408 2240 2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe 28 PID 2408 wrote to memory of 2820 2408 1027.tmp 29 PID 2408 wrote to memory of 2820 2408 1027.tmp 29 PID 2408 wrote to memory of 2820 2408 1027.tmp 29 PID 2408 wrote to memory of 2820 2408 1027.tmp 29 PID 2820 wrote to memory of 2172 2820 1056.tmp 30 PID 2820 wrote to memory of 2172 2820 1056.tmp 30 PID 2820 wrote to memory of 2172 2820 1056.tmp 30 PID 2820 wrote to memory of 2172 2820 1056.tmp 30 PID 2172 wrote to memory of 2556 2172 10E2.tmp 31 PID 2172 wrote to memory of 2556 2172 10E2.tmp 31 PID 2172 wrote to memory of 2556 2172 10E2.tmp 31 PID 2172 wrote to memory of 2556 2172 10E2.tmp 31 PID 2556 wrote to memory of 2672 2556 1120.tmp 32 PID 2556 wrote to memory of 2672 2556 1120.tmp 32 PID 2556 wrote to memory of 2672 2556 1120.tmp 32 PID 2556 wrote to memory of 2672 2556 1120.tmp 32 PID 2672 wrote to memory of 2616 2672 116E.tmp 33 PID 2672 wrote to memory of 2616 2672 116E.tmp 33 PID 2672 wrote to memory of 2616 2672 116E.tmp 33 PID 2672 wrote to memory of 2616 2672 116E.tmp 33 PID 2616 wrote to memory of 3024 2616 11AD.tmp 34 PID 2616 wrote to memory of 3024 2616 11AD.tmp 34 PID 2616 wrote to memory of 3024 2616 11AD.tmp 34 PID 2616 wrote to memory of 3024 2616 11AD.tmp 34 PID 3024 wrote to memory of 2800 3024 120A.tmp 35 PID 3024 wrote to memory of 2800 3024 120A.tmp 35 PID 3024 wrote to memory of 2800 3024 120A.tmp 35 PID 3024 wrote to memory of 2800 3024 120A.tmp 35 PID 2800 wrote to memory of 2652 2800 1258.tmp 36 PID 2800 wrote to memory of 2652 2800 1258.tmp 36 PID 2800 wrote to memory of 2652 2800 1258.tmp 36 PID 2800 wrote to memory of 2652 2800 1258.tmp 36 PID 2652 wrote to memory of 2520 2652 12A6.tmp 37 PID 2652 wrote to memory of 2520 2652 12A6.tmp 37 PID 2652 wrote to memory of 2520 2652 12A6.tmp 37 PID 2652 wrote to memory of 2520 2652 12A6.tmp 37 PID 2520 wrote to memory of 2516 2520 12F4.tmp 38 PID 2520 wrote to memory of 2516 2520 12F4.tmp 38 PID 2520 wrote to memory of 2516 2520 12F4.tmp 38 PID 2520 wrote to memory of 2516 2520 12F4.tmp 38 PID 2516 wrote to memory of 2756 2516 1333.tmp 39 PID 2516 wrote to memory of 2756 2516 1333.tmp 39 PID 2516 wrote to memory of 2756 2516 1333.tmp 39 PID 2516 wrote to memory of 2756 2516 1333.tmp 39 PID 2756 wrote to memory of 2412 2756 1371.tmp 40 PID 2756 wrote to memory of 2412 2756 1371.tmp 40 PID 2756 wrote to memory of 2412 2756 1371.tmp 40 PID 2756 wrote to memory of 2412 2756 1371.tmp 40 PID 2412 wrote to memory of 1788 2412 13BF.tmp 41 PID 2412 wrote to memory of 1788 2412 13BF.tmp 41 PID 2412 wrote to memory of 1788 2412 13BF.tmp 41 PID 2412 wrote to memory of 1788 2412 13BF.tmp 41 PID 1788 wrote to memory of 2648 1788 13FE.tmp 42 PID 1788 wrote to memory of 2648 1788 13FE.tmp 42 PID 1788 wrote to memory of 2648 1788 13FE.tmp 42 PID 1788 wrote to memory of 2648 1788 13FE.tmp 42 PID 2648 wrote to memory of 1672 2648 143C.tmp 43 PID 2648 wrote to memory of 1672 2648 143C.tmp 43 PID 2648 wrote to memory of 1672 2648 143C.tmp 43 PID 2648 wrote to memory of 1672 2648 143C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_c220c354646de36d9762158e9391b1e1_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"65⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"66⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"67⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"68⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"69⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"70⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"71⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"74⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"75⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"76⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"77⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"78⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"79⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"80⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"81⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"82⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"83⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"84⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"86⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"88⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"89⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"90⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"91⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"92⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"93⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"94⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"95⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"96⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"97⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"98⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"99⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"100⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"101⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"102⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"103⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"104⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"105⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"106⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"107⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"108⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"109⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"110⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"111⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"112⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"113⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"114⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"115⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"116⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"117⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"118⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"119⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"120⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"121⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-