Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/06/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe
-
Size
536KB
-
MD5
cc3337c690becc574f4ecf517267e7e5
-
SHA1
8afab0d25d15a6ec13edff62163f5ed669de738b
-
SHA256
1a0f8c80d6278385a8e69aa900dd4944dc7964ad218b8ec83e6a1c89af2d8c7a
-
SHA512
a2e892d774ec2412538f5d32b5fec3a8c413f5ccd811e583b1f402b8a62de2f352cb385eb9b6925930ead14db4fdc79b1e88b06f728dca1ee61ce04d55b0fce2
-
SSDEEP
12288:wU5rCOTeiUwXuOxj0qYwyHl4KZPOF7K7MqhbRFb0APQIZxVJ0ZT9:wUQOJUw+qwqYbbmhGPcIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2684 E91.tmp 3060 EEF.tmp 3008 F7B.tmp 2668 FE8.tmp 2588 1075.tmp 1436 10C3.tmp 2760 1111.tmp 2692 11AD.tmp 2632 1249.tmp 1500 1297.tmp 1876 12E5.tmp 1912 1333.tmp 1924 1371.tmp 1836 13B0.tmp 2524 13EE.tmp 2948 142C.tmp 1852 146B.tmp 2092 14A9.tmp 2100 14E8.tmp 2420 1526.tmp 1760 1564.tmp 600 15A3.tmp 1048 15E1.tmp 1504 1620.tmp 1988 165E.tmp 1740 169C.tmp 844 16DB.tmp 3028 1719.tmp 1076 1758.tmp 1580 1796.tmp 1636 17D4.tmp 1056 1813.tmp 2044 1890.tmp 724 18FD.tmp 2248 195A.tmp 2340 19C8.tmp 1780 1A06.tmp 1772 1A64.tmp 2364 1AC1.tmp 1628 1B00.tmp 2688 1B3E.tmp 3048 1B7C.tmp 820 1BCA.tmp 3060 1C09.tmp 2656 1C57.tmp 2700 1CA5.tmp 2472 1CE3.tmp 2588 1D22.tmp 2744 1D60.tmp 2736 1DBE.tmp 2476 1DFC.tmp 2540 1E4A.tmp 1756 1E88.tmp 864 1ED6.tmp 2976 1F05.tmp 2940 1F44.tmp 2440 1F82.tmp 2704 1FC0.tmp 2900 1FFF.tmp 1844 203D.tmp 2060 207C.tmp 2184 20CA.tmp 2952 2108.tmp 2296 2146.tmp -
Loads dropped DLL 64 IoCs
pid Process 2372 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 2684 E91.tmp 3060 EEF.tmp 3008 F7B.tmp 2668 FE8.tmp 2588 1075.tmp 1436 10C3.tmp 2760 1111.tmp 2692 11AD.tmp 2632 1249.tmp 1500 1297.tmp 1876 12E5.tmp 1912 1333.tmp 1924 1371.tmp 1836 13B0.tmp 2524 13EE.tmp 2948 142C.tmp 1852 146B.tmp 2092 14A9.tmp 2100 14E8.tmp 2420 1526.tmp 1760 1564.tmp 600 15A3.tmp 1048 15E1.tmp 1504 1620.tmp 1988 165E.tmp 1740 169C.tmp 844 16DB.tmp 3028 1719.tmp 1076 1758.tmp 1580 1796.tmp 1636 17D4.tmp 1056 1813.tmp 2044 1890.tmp 724 18FD.tmp 2248 195A.tmp 2340 19C8.tmp 1780 1A06.tmp 1772 1A64.tmp 2364 1AC1.tmp 1628 1B00.tmp 2688 1B3E.tmp 3048 1B7C.tmp 820 1BCA.tmp 3060 1C09.tmp 2656 1C57.tmp 2700 1CA5.tmp 2472 1CE3.tmp 2588 1D22.tmp 2744 1D60.tmp 2736 1DBE.tmp 2476 1DFC.tmp 2540 1E4A.tmp 1756 1E88.tmp 864 1ED6.tmp 2976 1F05.tmp 2940 1F44.tmp 2440 1F82.tmp 2704 1FC0.tmp 2900 1FFF.tmp 1844 203D.tmp 2060 207C.tmp 2184 20CA.tmp 2952 2108.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2684 2372 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 28 PID 2372 wrote to memory of 2684 2372 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 28 PID 2372 wrote to memory of 2684 2372 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 28 PID 2372 wrote to memory of 2684 2372 2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe 28 PID 2684 wrote to memory of 3060 2684 E91.tmp 29 PID 2684 wrote to memory of 3060 2684 E91.tmp 29 PID 2684 wrote to memory of 3060 2684 E91.tmp 29 PID 2684 wrote to memory of 3060 2684 E91.tmp 29 PID 3060 wrote to memory of 3008 3060 EEF.tmp 30 PID 3060 wrote to memory of 3008 3060 EEF.tmp 30 PID 3060 wrote to memory of 3008 3060 EEF.tmp 30 PID 3060 wrote to memory of 3008 3060 EEF.tmp 30 PID 3008 wrote to memory of 2668 3008 F7B.tmp 31 PID 3008 wrote to memory of 2668 3008 F7B.tmp 31 PID 3008 wrote to memory of 2668 3008 F7B.tmp 31 PID 3008 wrote to memory of 2668 3008 F7B.tmp 31 PID 2668 wrote to memory of 2588 2668 FE8.tmp 32 PID 2668 wrote to memory of 2588 2668 FE8.tmp 32 PID 2668 wrote to memory of 2588 2668 FE8.tmp 32 PID 2668 wrote to memory of 2588 2668 FE8.tmp 32 PID 2588 wrote to memory of 1436 2588 1075.tmp 33 PID 2588 wrote to memory of 1436 2588 1075.tmp 33 PID 2588 wrote to memory of 1436 2588 1075.tmp 33 PID 2588 wrote to memory of 1436 2588 1075.tmp 33 PID 1436 wrote to memory of 2760 1436 10C3.tmp 34 PID 1436 wrote to memory of 2760 1436 10C3.tmp 34 PID 1436 wrote to memory of 2760 1436 10C3.tmp 34 PID 1436 wrote to memory of 2760 1436 10C3.tmp 34 PID 2760 wrote to memory of 2692 2760 1111.tmp 35 PID 2760 wrote to memory of 2692 2760 1111.tmp 35 PID 2760 wrote to memory of 2692 2760 1111.tmp 35 PID 2760 wrote to memory of 2692 2760 1111.tmp 35 PID 2692 wrote to memory of 2632 2692 11AD.tmp 36 PID 2692 wrote to memory of 2632 2692 11AD.tmp 36 PID 2692 wrote to memory of 2632 2692 11AD.tmp 36 PID 2692 wrote to memory of 2632 2692 11AD.tmp 36 PID 2632 wrote to memory of 1500 2632 1249.tmp 37 PID 2632 wrote to memory of 1500 2632 1249.tmp 37 PID 2632 wrote to memory of 1500 2632 1249.tmp 37 PID 2632 wrote to memory of 1500 2632 1249.tmp 37 PID 1500 wrote to memory of 1876 1500 1297.tmp 38 PID 1500 wrote to memory of 1876 1500 1297.tmp 38 PID 1500 wrote to memory of 1876 1500 1297.tmp 38 PID 1500 wrote to memory of 1876 1500 1297.tmp 38 PID 1876 wrote to memory of 1912 1876 12E5.tmp 39 PID 1876 wrote to memory of 1912 1876 12E5.tmp 39 PID 1876 wrote to memory of 1912 1876 12E5.tmp 39 PID 1876 wrote to memory of 1912 1876 12E5.tmp 39 PID 1912 wrote to memory of 1924 1912 1333.tmp 40 PID 1912 wrote to memory of 1924 1912 1333.tmp 40 PID 1912 wrote to memory of 1924 1912 1333.tmp 40 PID 1912 wrote to memory of 1924 1912 1333.tmp 40 PID 1924 wrote to memory of 1836 1924 1371.tmp 41 PID 1924 wrote to memory of 1836 1924 1371.tmp 41 PID 1924 wrote to memory of 1836 1924 1371.tmp 41 PID 1924 wrote to memory of 1836 1924 1371.tmp 41 PID 1836 wrote to memory of 2524 1836 13B0.tmp 42 PID 1836 wrote to memory of 2524 1836 13B0.tmp 42 PID 1836 wrote to memory of 2524 1836 13B0.tmp 42 PID 1836 wrote to memory of 2524 1836 13B0.tmp 42 PID 2524 wrote to memory of 2948 2524 13EE.tmp 43 PID 2524 wrote to memory of 2948 2524 13EE.tmp 43 PID 2524 wrote to memory of 2948 2524 13EE.tmp 43 PID 2524 wrote to memory of 2948 2524 13EE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-24_cc3337c690becc574f4ecf517267e7e5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1297.tmp"C:\Users\Admin\AppData\Local\Temp\1297.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\13EE.tmp"C:\Users\Admin\AppData\Local\Temp\13EE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:724 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"65⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"66⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"67⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"68⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"69⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"70⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"71⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"72⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"73⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"74⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"75⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"76⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"77⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"78⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"79⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"80⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"81⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"82⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"83⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"84⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"85⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"86⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"87⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"88⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"89⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"90⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"91⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"92⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"93⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"94⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"95⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"96⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"97⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"98⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"99⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"100⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"101⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"102⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"103⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"104⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"105⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"106⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"107⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"108⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"109⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"110⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"111⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"112⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"113⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"114⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"115⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"116⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"117⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"118⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"119⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"120⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"121⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"122⤵PID:1840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-