Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe
-
Size
488KB
-
MD5
cf3d7d144b858ae0d7ac0203ce0c4369
-
SHA1
fa54f09325321c674c923c19e24be266b035ef67
-
SHA256
7b43c1da3ad18014bb610d0e80e79435645c2c4d87d5216c046c7edeac59b23f
-
SHA512
c1c3326ae62b8aa8d9a5042ab24209502acef96689f5b46728effba7c73b80cc646a3aff7c355bd8a005e93e9c801d5770a5c4769a1795d902d6039fefc23701
-
SSDEEP
12288:/U5rCOTeiDRC2kte485QXDU3YkED0dLFfwNZ:/UQOJD02k2eTUXhwN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1252 DF5.tmp 2832 E53.tmp 2312 EC0.tmp 844 F1E.tmp 2688 F6C.tmp 2568 FE8.tmp 2624 1056.tmp 2780 10B3.tmp 2512 1130.tmp 2480 118E.tmp 2632 120A.tmp 1876 1249.tmp 1040 12B6.tmp 2440 1333.tmp 2760 13A0.tmp 2824 140D.tmp 2564 147A.tmp 2156 14E8.tmp 1284 1555.tmp 1844 15C2.tmp 2804 163F.tmp 1836 16BC.tmp 1624 1729.tmp 1504 1767.tmp 2176 17A6.tmp 2300 17E4.tmp 2236 1822.tmp 1676 1861.tmp 2872 189F.tmp 2772 18DE.tmp 2224 191C.tmp 484 195A.tmp 1112 1999.tmp 2416 19D7.tmp 828 1A16.tmp 328 1A64.tmp 692 1AA2.tmp 2428 1AE0.tmp 2080 1B1F.tmp 3016 1B5D.tmp 3068 1B9C.tmp 1552 1BDA.tmp 864 1C18.tmp 1088 1C66.tmp 2324 1CA5.tmp 2188 1CE3.tmp 920 1D31.tmp 1244 1D70.tmp 2972 1DAE.tmp 772 1DEC.tmp 2204 1E3A.tmp 980 1E79.tmp 1492 1EB7.tmp 468 1F05.tmp 2892 1F44.tmp 2740 1FB1.tmp 1328 1FEF.tmp 1680 202E.tmp 2068 206C.tmp 2608 20AA.tmp 2604 20F8.tmp 2572 2137.tmp 2680 2185.tmp 2620 21D3.tmp -
Loads dropped DLL 64 IoCs
pid Process 1276 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 1252 DF5.tmp 2832 E53.tmp 2312 EC0.tmp 844 F1E.tmp 2688 F6C.tmp 2568 FE8.tmp 2624 1056.tmp 2780 10B3.tmp 2512 1130.tmp 2480 118E.tmp 2632 120A.tmp 1876 1249.tmp 1040 12B6.tmp 2440 1333.tmp 2760 13A0.tmp 2824 140D.tmp 2564 147A.tmp 2156 14E8.tmp 1284 1555.tmp 1844 15C2.tmp 2804 163F.tmp 1836 16BC.tmp 1624 1729.tmp 1504 1767.tmp 2176 17A6.tmp 2300 17E4.tmp 2236 1822.tmp 1676 1861.tmp 2872 189F.tmp 2772 18DE.tmp 2224 191C.tmp 484 195A.tmp 1112 1999.tmp 2416 19D7.tmp 828 1A16.tmp 328 1A64.tmp 692 1AA2.tmp 2428 1AE0.tmp 2080 1B1F.tmp 3016 1B5D.tmp 3068 1B9C.tmp 1552 1BDA.tmp 864 1C18.tmp 1088 1C66.tmp 2324 1CA5.tmp 2188 1CE3.tmp 920 1D31.tmp 1244 1D70.tmp 2972 1DAE.tmp 772 1DEC.tmp 2204 1E3A.tmp 980 1E79.tmp 1492 1EB7.tmp 468 1F05.tmp 2892 1F44.tmp 2740 1FB1.tmp 1328 1FEF.tmp 1680 202E.tmp 2068 206C.tmp 2608 20AA.tmp 2604 20F8.tmp 2572 2137.tmp 2680 2185.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1276 wrote to memory of 1252 1276 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 28 PID 1276 wrote to memory of 1252 1276 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 28 PID 1276 wrote to memory of 1252 1276 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 28 PID 1276 wrote to memory of 1252 1276 2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe 28 PID 1252 wrote to memory of 2832 1252 DF5.tmp 29 PID 1252 wrote to memory of 2832 1252 DF5.tmp 29 PID 1252 wrote to memory of 2832 1252 DF5.tmp 29 PID 1252 wrote to memory of 2832 1252 DF5.tmp 29 PID 2832 wrote to memory of 2312 2832 E53.tmp 30 PID 2832 wrote to memory of 2312 2832 E53.tmp 30 PID 2832 wrote to memory of 2312 2832 E53.tmp 30 PID 2832 wrote to memory of 2312 2832 E53.tmp 30 PID 2312 wrote to memory of 844 2312 EC0.tmp 31 PID 2312 wrote to memory of 844 2312 EC0.tmp 31 PID 2312 wrote to memory of 844 2312 EC0.tmp 31 PID 2312 wrote to memory of 844 2312 EC0.tmp 31 PID 844 wrote to memory of 2688 844 F1E.tmp 32 PID 844 wrote to memory of 2688 844 F1E.tmp 32 PID 844 wrote to memory of 2688 844 F1E.tmp 32 PID 844 wrote to memory of 2688 844 F1E.tmp 32 PID 2688 wrote to memory of 2568 2688 F6C.tmp 33 PID 2688 wrote to memory of 2568 2688 F6C.tmp 33 PID 2688 wrote to memory of 2568 2688 F6C.tmp 33 PID 2688 wrote to memory of 2568 2688 F6C.tmp 33 PID 2568 wrote to memory of 2624 2568 FE8.tmp 34 PID 2568 wrote to memory of 2624 2568 FE8.tmp 34 PID 2568 wrote to memory of 2624 2568 FE8.tmp 34 PID 2568 wrote to memory of 2624 2568 FE8.tmp 34 PID 2624 wrote to memory of 2780 2624 1056.tmp 35 PID 2624 wrote to memory of 2780 2624 1056.tmp 35 PID 2624 wrote to memory of 2780 2624 1056.tmp 35 PID 2624 wrote to memory of 2780 2624 1056.tmp 35 PID 2780 wrote to memory of 2512 2780 10B3.tmp 36 PID 2780 wrote to memory of 2512 2780 10B3.tmp 36 PID 2780 wrote to memory of 2512 2780 10B3.tmp 36 PID 2780 wrote to memory of 2512 2780 10B3.tmp 36 PID 2512 wrote to memory of 2480 2512 1130.tmp 37 PID 2512 wrote to memory of 2480 2512 1130.tmp 37 PID 2512 wrote to memory of 2480 2512 1130.tmp 37 PID 2512 wrote to memory of 2480 2512 1130.tmp 37 PID 2480 wrote to memory of 2632 2480 118E.tmp 38 PID 2480 wrote to memory of 2632 2480 118E.tmp 38 PID 2480 wrote to memory of 2632 2480 118E.tmp 38 PID 2480 wrote to memory of 2632 2480 118E.tmp 38 PID 2632 wrote to memory of 1876 2632 120A.tmp 39 PID 2632 wrote to memory of 1876 2632 120A.tmp 39 PID 2632 wrote to memory of 1876 2632 120A.tmp 39 PID 2632 wrote to memory of 1876 2632 120A.tmp 39 PID 1876 wrote to memory of 1040 1876 1249.tmp 40 PID 1876 wrote to memory of 1040 1876 1249.tmp 40 PID 1876 wrote to memory of 1040 1876 1249.tmp 40 PID 1876 wrote to memory of 1040 1876 1249.tmp 40 PID 1040 wrote to memory of 2440 1040 12B6.tmp 41 PID 1040 wrote to memory of 2440 1040 12B6.tmp 41 PID 1040 wrote to memory of 2440 1040 12B6.tmp 41 PID 1040 wrote to memory of 2440 1040 12B6.tmp 41 PID 2440 wrote to memory of 2760 2440 1333.tmp 42 PID 2440 wrote to memory of 2760 2440 1333.tmp 42 PID 2440 wrote to memory of 2760 2440 1333.tmp 42 PID 2440 wrote to memory of 2760 2440 1333.tmp 42 PID 2760 wrote to memory of 2824 2760 13A0.tmp 43 PID 2760 wrote to memory of 2824 2760 13A0.tmp 43 PID 2760 wrote to memory of 2824 2760 13A0.tmp 43 PID 2760 wrote to memory of 2824 2760 13A0.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_cf3d7d144b858ae0d7ac0203ce0c4369_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"66⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"67⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"69⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"71⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"72⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"73⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"74⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"75⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"76⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"77⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"78⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"79⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"80⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"82⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"83⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"84⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"85⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"86⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"87⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"88⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"89⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"90⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"91⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"92⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"93⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"94⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"95⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"96⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"97⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"98⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"99⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"100⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"101⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"102⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"103⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"104⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"105⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"106⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"107⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"110⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"111⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"112⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"113⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"114⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"115⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"116⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"117⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"118⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"119⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"120⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"121⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-