Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/06/2024, 05:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe
-
Size
536KB
-
MD5
0874819912a74d859bec7c059718645f
-
SHA1
e9dd10565a171478313d1b754b2a7d27ce81a229
-
SHA256
dd100b6712a61aecf373d48ef07dba8dcd4b45005fafb29191173726a363d759
-
SHA512
699734e1a88625461edbe53c23f65c969731ed7a12e13170b87a9ac32b4a7a4ceb8a5f21d75a8c13f099228171527451475b880679f34d1e93f0414e4cdc8529
-
SSDEEP
12288:wU5rCOTeiUDMGCmIYG6ahaYbyFqdCtIZxVJ0ZT9:wUQOJUPFJzawO7oIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2148 201E.tmp 3044 206C.tmp 3024 20E9.tmp 2636 2166.tmp 2552 2202.tmp 2708 227E.tmp 2472 22FB.tmp 2444 2378.tmp 2524 23E5.tmp 1252 2452.tmp 1508 24A0.tmp 1668 24EE.tmp 1472 256B.tmp 292 25C9.tmp 2680 2626.tmp 2792 2674.tmp 856 26B3.tmp 2372 2701.tmp 2852 274F.tmp 2024 27AC.tmp 1968 27FA.tmp 240 2858.tmp 1368 28B6.tmp 108 2932.tmp 808 29CE.tmp 2188 2A1C.tmp 2660 2AA9.tmp 2380 2AE7.tmp 1828 2B35.tmp 312 2B83.tmp 2940 2BC2.tmp 1172 2C00.tmp 2260 2C5E.tmp 2084 2CDA.tmp 532 2D67.tmp 2208 2DA5.tmp 1684 2DE4.tmp 1608 2E22.tmp 1892 2E60.tmp 2052 2E9F.tmp 3036 2EDD.tmp 2144 2F1C.tmp 2132 2F6A.tmp 2592 2FA8.tmp 2572 2FE6.tmp 2696 3025.tmp 2560 3063.tmp 2512 30A2.tmp 2524 30E0.tmp 1252 311E.tmp 1676 315D.tmp 1572 319B.tmp 292 31F9.tmp 2724 3247.tmp 1192 3285.tmp 2372 32C4.tmp 2240 3302.tmp 1352 3340.tmp 240 337F.tmp 572 33BD.tmp 108 33FC.tmp 2412 343A.tmp 2188 3478.tmp 2660 34B7.tmp -
Loads dropped DLL 64 IoCs
pid Process 2344 2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe 2148 201E.tmp 3044 206C.tmp 3024 20E9.tmp 2636 2166.tmp 2552 2202.tmp 2708 227E.tmp 2472 22FB.tmp 2444 2378.tmp 2524 23E5.tmp 1252 2452.tmp 1508 24A0.tmp 1668 24EE.tmp 1472 256B.tmp 292 25C9.tmp 2680 2626.tmp 2792 2674.tmp 856 26B3.tmp 2372 2701.tmp 2852 274F.tmp 2024 27AC.tmp 1968 27FA.tmp 240 2858.tmp 1368 28B6.tmp 108 2932.tmp 808 29CE.tmp 2188 2A1C.tmp 2660 2AA9.tmp 2380 2AE7.tmp 1828 2B35.tmp 312 2B83.tmp 2940 2BC2.tmp 1172 2C00.tmp 2260 2C5E.tmp 2084 2CDA.tmp 532 2D67.tmp 2208 2DA5.tmp 1684 2DE4.tmp 1608 2E22.tmp 1892 2E60.tmp 2052 2E9F.tmp 3036 2EDD.tmp 2144 2F1C.tmp 2132 2F6A.tmp 2592 2FA8.tmp 2572 2FE6.tmp 2696 3025.tmp 2560 3063.tmp 2512 30A2.tmp 2524 30E0.tmp 1252 311E.tmp 1676 315D.tmp 1572 319B.tmp 292 31F9.tmp 2724 3247.tmp 1192 3285.tmp 2372 32C4.tmp 2240 3302.tmp 1352 3340.tmp 240 337F.tmp 572 33BD.tmp 108 33FC.tmp 2412 343A.tmp 2188 3478.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2148 2344 2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe 28 PID 2344 wrote to memory of 2148 2344 2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe 28 PID 2344 wrote to memory of 2148 2344 2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe 28 PID 2344 wrote to memory of 2148 2344 2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe 28 PID 2148 wrote to memory of 3044 2148 201E.tmp 29 PID 2148 wrote to memory of 3044 2148 201E.tmp 29 PID 2148 wrote to memory of 3044 2148 201E.tmp 29 PID 2148 wrote to memory of 3044 2148 201E.tmp 29 PID 3044 wrote to memory of 3024 3044 206C.tmp 208 PID 3044 wrote to memory of 3024 3044 206C.tmp 208 PID 3044 wrote to memory of 3024 3044 206C.tmp 208 PID 3044 wrote to memory of 3024 3044 206C.tmp 208 PID 3024 wrote to memory of 2636 3024 20E9.tmp 31 PID 3024 wrote to memory of 2636 3024 20E9.tmp 31 PID 3024 wrote to memory of 2636 3024 20E9.tmp 31 PID 3024 wrote to memory of 2636 3024 20E9.tmp 31 PID 2636 wrote to memory of 2552 2636 2166.tmp 32 PID 2636 wrote to memory of 2552 2636 2166.tmp 32 PID 2636 wrote to memory of 2552 2636 2166.tmp 32 PID 2636 wrote to memory of 2552 2636 2166.tmp 32 PID 2552 wrote to memory of 2708 2552 2202.tmp 33 PID 2552 wrote to memory of 2708 2552 2202.tmp 33 PID 2552 wrote to memory of 2708 2552 2202.tmp 33 PID 2552 wrote to memory of 2708 2552 2202.tmp 33 PID 2708 wrote to memory of 2472 2708 227E.tmp 34 PID 2708 wrote to memory of 2472 2708 227E.tmp 34 PID 2708 wrote to memory of 2472 2708 227E.tmp 34 PID 2708 wrote to memory of 2472 2708 227E.tmp 34 PID 2472 wrote to memory of 2444 2472 22FB.tmp 35 PID 2472 wrote to memory of 2444 2472 22FB.tmp 35 PID 2472 wrote to memory of 2444 2472 22FB.tmp 35 PID 2472 wrote to memory of 2444 2472 22FB.tmp 35 PID 2444 wrote to memory of 2524 2444 2378.tmp 36 PID 2444 wrote to memory of 2524 2444 2378.tmp 36 PID 2444 wrote to memory of 2524 2444 2378.tmp 36 PID 2444 wrote to memory of 2524 2444 2378.tmp 36 PID 2524 wrote to memory of 1252 2524 23E5.tmp 37 PID 2524 wrote to memory of 1252 2524 23E5.tmp 37 PID 2524 wrote to memory of 1252 2524 23E5.tmp 37 PID 2524 wrote to memory of 1252 2524 23E5.tmp 37 PID 1252 wrote to memory of 1508 1252 2452.tmp 38 PID 1252 wrote to memory of 1508 1252 2452.tmp 38 PID 1252 wrote to memory of 1508 1252 2452.tmp 38 PID 1252 wrote to memory of 1508 1252 2452.tmp 38 PID 1508 wrote to memory of 1668 1508 24A0.tmp 39 PID 1508 wrote to memory of 1668 1508 24A0.tmp 39 PID 1508 wrote to memory of 1668 1508 24A0.tmp 39 PID 1508 wrote to memory of 1668 1508 24A0.tmp 39 PID 1668 wrote to memory of 1472 1668 24EE.tmp 40 PID 1668 wrote to memory of 1472 1668 24EE.tmp 40 PID 1668 wrote to memory of 1472 1668 24EE.tmp 40 PID 1668 wrote to memory of 1472 1668 24EE.tmp 40 PID 1472 wrote to memory of 292 1472 256B.tmp 41 PID 1472 wrote to memory of 292 1472 256B.tmp 41 PID 1472 wrote to memory of 292 1472 256B.tmp 41 PID 1472 wrote to memory of 292 1472 256B.tmp 41 PID 292 wrote to memory of 2680 292 25C9.tmp 42 PID 292 wrote to memory of 2680 292 25C9.tmp 42 PID 292 wrote to memory of 2680 292 25C9.tmp 42 PID 292 wrote to memory of 2680 292 25C9.tmp 42 PID 2680 wrote to memory of 2792 2680 2626.tmp 43 PID 2680 wrote to memory of 2792 2680 2626.tmp 43 PID 2680 wrote to memory of 2792 2680 2626.tmp 43 PID 2680 wrote to memory of 2792 2680 2626.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_0874819912a74d859bec7c059718645f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"65⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"66⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"67⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"68⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"69⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"70⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"71⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"72⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"73⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"74⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"75⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"76⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"77⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"78⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"79⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"80⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"81⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"82⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3949.tmp"C:\Users\Admin\AppData\Local\Temp\3949.tmp"83⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"84⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"85⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"86⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"87⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"88⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"89⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"90⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"92⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"93⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"94⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"95⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"96⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"97⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"98⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"99⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"100⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"101⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"102⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"103⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"104⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"105⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"106⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"107⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"108⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"109⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"110⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"111⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"112⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"113⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"114⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"115⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"116⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"117⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"118⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"119⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"120⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"121⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"122⤵PID:1340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-