Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 02:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe
-
Size
529KB
-
MD5
5c338ad5abc324135217d39756705321
-
SHA1
583f0ddebb163a2e0514950765b04494e967d71e
-
SHA256
2a1e02b307373d6a225adea8dbd9debb86a642ca9bb21d70e97414992a48ea14
-
SHA512
ad4dfeeffbbd7d64d3620233a4bd5069033e48dfd7fed3a1664f1d2188bbedb44fa656bb197567b30fde2ea9943209f3c4ee5a3e80989c188fdad8de5c8bc15d
-
SSDEEP
12288:NU5rCOTeijVz6zJgmFvXlRjd0dIcaWOMdOS/1iTZwlH4Hp:NUQOJj2hFvVRjmeWOMd9/ITSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2344 E05.tmp 3060 E72.tmp 1920 EFE.tmp 2728 F6C.tmp 2724 FC9.tmp 2532 1036.tmp 2796 10B3.tmp 3004 1130.tmp 2580 119D.tmp 2568 121A.tmp 3008 1297.tmp 1812 1314.tmp 340 1390.tmp 2616 140D.tmp 2852 148A.tmp 1124 14E8.tmp 2220 1555.tmp 2420 15D2.tmp 2000 163F.tmp 852 16AC.tmp 860 1729.tmp 2196 17A6.tmp 2284 1803.tmp 1628 1851.tmp 1188 1890.tmp 2076 18CE.tmp 2508 190C.tmp 1968 194B.tmp 2896 1989.tmp 2056 19C8.tmp 532 1A06.tmp 580 1A44.tmp 1488 1A83.tmp 1644 1AC1.tmp 1912 1B0F.tmp 1800 1B4E.tmp 1084 1B8C.tmp 948 1BCA.tmp 1136 1C09.tmp 2336 1C47.tmp 1368 1C86.tmp 1832 1CC4.tmp 1312 1D02.tmp 1924 1D41.tmp 1156 1D7F.tmp 3056 1DBE.tmp 284 1DFC.tmp 2864 1E3A.tmp 1224 1E79.tmp 2448 1EB7.tmp 1784 1F05.tmp 268 1F44.tmp 2312 1F82.tmp 1044 1FC0.tmp 628 1FFF.tmp 2348 203D.tmp 2040 207C.tmp 2468 20BA.tmp 2344 2108.tmp 2100 2146.tmp 2668 2194.tmp 2744 21E2.tmp 2676 2221.tmp 2632 225F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2164 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 2344 E05.tmp 3060 E72.tmp 1920 EFE.tmp 2728 F6C.tmp 2724 FC9.tmp 2532 1036.tmp 2796 10B3.tmp 3004 1130.tmp 2580 119D.tmp 2568 121A.tmp 3008 1297.tmp 1812 1314.tmp 340 1390.tmp 2616 140D.tmp 2852 148A.tmp 1124 14E8.tmp 2220 1555.tmp 2420 15D2.tmp 2000 163F.tmp 852 16AC.tmp 860 1729.tmp 2196 17A6.tmp 2284 1803.tmp 1628 1851.tmp 1188 1890.tmp 2076 18CE.tmp 2508 190C.tmp 1968 194B.tmp 2896 1989.tmp 2056 19C8.tmp 532 1A06.tmp 580 1A44.tmp 1488 1A83.tmp 1644 1AC1.tmp 1912 1B0F.tmp 1800 1B4E.tmp 1084 1B8C.tmp 948 1BCA.tmp 1136 1C09.tmp 2336 1C47.tmp 1368 1C86.tmp 1832 1CC4.tmp 1312 1D02.tmp 1924 1D41.tmp 1156 1D7F.tmp 3056 1DBE.tmp 284 1DFC.tmp 2864 1E3A.tmp 1224 1E79.tmp 2448 1EB7.tmp 1784 1F05.tmp 268 1F44.tmp 2312 1F82.tmp 1044 1FC0.tmp 628 1FFF.tmp 2348 203D.tmp 2040 207C.tmp 2468 20BA.tmp 2344 2108.tmp 2100 2146.tmp 2668 2194.tmp 2744 21E2.tmp 2676 2221.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2344 2164 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 28 PID 2164 wrote to memory of 2344 2164 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 28 PID 2164 wrote to memory of 2344 2164 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 28 PID 2164 wrote to memory of 2344 2164 2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe 28 PID 2344 wrote to memory of 3060 2344 E05.tmp 29 PID 2344 wrote to memory of 3060 2344 E05.tmp 29 PID 2344 wrote to memory of 3060 2344 E05.tmp 29 PID 2344 wrote to memory of 3060 2344 E05.tmp 29 PID 3060 wrote to memory of 1920 3060 E72.tmp 30 PID 3060 wrote to memory of 1920 3060 E72.tmp 30 PID 3060 wrote to memory of 1920 3060 E72.tmp 30 PID 3060 wrote to memory of 1920 3060 E72.tmp 30 PID 1920 wrote to memory of 2728 1920 EFE.tmp 31 PID 1920 wrote to memory of 2728 1920 EFE.tmp 31 PID 1920 wrote to memory of 2728 1920 EFE.tmp 31 PID 1920 wrote to memory of 2728 1920 EFE.tmp 31 PID 2728 wrote to memory of 2724 2728 F6C.tmp 32 PID 2728 wrote to memory of 2724 2728 F6C.tmp 32 PID 2728 wrote to memory of 2724 2728 F6C.tmp 32 PID 2728 wrote to memory of 2724 2728 F6C.tmp 32 PID 2724 wrote to memory of 2532 2724 FC9.tmp 33 PID 2724 wrote to memory of 2532 2724 FC9.tmp 33 PID 2724 wrote to memory of 2532 2724 FC9.tmp 33 PID 2724 wrote to memory of 2532 2724 FC9.tmp 33 PID 2532 wrote to memory of 2796 2532 1036.tmp 34 PID 2532 wrote to memory of 2796 2532 1036.tmp 34 PID 2532 wrote to memory of 2796 2532 1036.tmp 34 PID 2532 wrote to memory of 2796 2532 1036.tmp 34 PID 2796 wrote to memory of 3004 2796 10B3.tmp 35 PID 2796 wrote to memory of 3004 2796 10B3.tmp 35 PID 2796 wrote to memory of 3004 2796 10B3.tmp 35 PID 2796 wrote to memory of 3004 2796 10B3.tmp 35 PID 3004 wrote to memory of 2580 3004 1130.tmp 36 PID 3004 wrote to memory of 2580 3004 1130.tmp 36 PID 3004 wrote to memory of 2580 3004 1130.tmp 36 PID 3004 wrote to memory of 2580 3004 1130.tmp 36 PID 2580 wrote to memory of 2568 2580 119D.tmp 37 PID 2580 wrote to memory of 2568 2580 119D.tmp 37 PID 2580 wrote to memory of 2568 2580 119D.tmp 37 PID 2580 wrote to memory of 2568 2580 119D.tmp 37 PID 2568 wrote to memory of 3008 2568 121A.tmp 38 PID 2568 wrote to memory of 3008 2568 121A.tmp 38 PID 2568 wrote to memory of 3008 2568 121A.tmp 38 PID 2568 wrote to memory of 3008 2568 121A.tmp 38 PID 3008 wrote to memory of 1812 3008 1297.tmp 39 PID 3008 wrote to memory of 1812 3008 1297.tmp 39 PID 3008 wrote to memory of 1812 3008 1297.tmp 39 PID 3008 wrote to memory of 1812 3008 1297.tmp 39 PID 1812 wrote to memory of 340 1812 1314.tmp 40 PID 1812 wrote to memory of 340 1812 1314.tmp 40 PID 1812 wrote to memory of 340 1812 1314.tmp 40 PID 1812 wrote to memory of 340 1812 1314.tmp 40 PID 340 wrote to memory of 2616 340 1390.tmp 41 PID 340 wrote to memory of 2616 340 1390.tmp 41 PID 340 wrote to memory of 2616 340 1390.tmp 41 PID 340 wrote to memory of 2616 340 1390.tmp 41 PID 2616 wrote to memory of 2852 2616 140D.tmp 42 PID 2616 wrote to memory of 2852 2616 140D.tmp 42 PID 2616 wrote to memory of 2852 2616 140D.tmp 42 PID 2616 wrote to memory of 2852 2616 140D.tmp 42 PID 2852 wrote to memory of 1124 2852 148A.tmp 43 PID 2852 wrote to memory of 1124 2852 148A.tmp 43 PID 2852 wrote to memory of 1124 2852 148A.tmp 43 PID 2852 wrote to memory of 1124 2852 148A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_5c338ad5abc324135217d39756705321_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\1390.tmp"C:\Users\Admin\AppData\Local\Temp\1390.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"65⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"68⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"69⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"70⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"71⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"72⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"74⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"75⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"76⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"77⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"78⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"79⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"80⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"81⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"82⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"83⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"84⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"85⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"86⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"87⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"88⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"89⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"90⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"91⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"92⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"93⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"94⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"95⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"96⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"98⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"99⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"100⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"101⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"102⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"103⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"104⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"105⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"106⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"107⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"108⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"109⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"110⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"111⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"112⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"113⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"114⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"115⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"116⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"117⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"118⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"119⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"120⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"121⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-