Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
30/06/2024, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe
-
Size
541KB
-
MD5
78cb7cd7971ecbea3f59c3fd5a5f640c
-
SHA1
7773be09c4373a8f19d8ca1c90906d627cfff27c
-
SHA256
98dd71f9103ed8074b660a49e2bbbc91bbb1447b329c7f7d841cdb7e5597b9bf
-
SHA512
1963cfbe55c8e8ecb9b2b1f210359fe0f52b1132eb734c75327c87c139be367b6c80d163b948d68308de05d083b3ec806ff963bed1878ae4c091b5194196cb55
-
SSDEEP
12288:UU5rCOTeiffnmY2kTVuCKLKdwLrnzExUQmNrZa73ctO:UUQOJffmY2CuKdwvzExUQmNrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1912 14E8.tmp 1880 1564.tmp 1224 1620.tmp 2744 16BC.tmp 2664 1729.tmp 2540 17C5.tmp 2272 1861.tmp 2636 18ED.tmp 2580 193B.tmp 2548 1999.tmp 1692 19E7.tmp 3052 1AA2.tmp 1716 1B2E.tmp 3020 1B8C.tmp 2044 1C38.tmp 2064 1CE3.tmp 1624 1D60.tmp 1580 1DEC.tmp 2508 1E98.tmp 2840 1F15.tmp 2964 1FB1.tmp 2156 202E.tmp 1368 206C.tmp 1544 20BA.tmp 1784 2108.tmp 2232 2146.tmp 2828 2194.tmp 2516 21E2.tmp 1088 2230.tmp 1112 226F.tmp 1924 22BD.tmp 604 22FB.tmp 788 2349.tmp 1052 2388.tmp 2140 23E5.tmp 1156 2433.tmp 804 2481.tmp 1968 24C0.tmp 1056 250E.tmp 2348 255C.tmp 2932 25AA.tmp 1824 25F8.tmp 1992 2636.tmp 1172 2674.tmp 272 26C2.tmp 2396 2710.tmp 2916 275E.tmp 1292 279D.tmp 2464 280A.tmp 1776 2858.tmp 2280 2896.tmp 2316 28E4.tmp 2192 2932.tmp 1984 2980.tmp 1412 29CE.tmp 1656 2A0D.tmp 1704 2A5B.tmp 2184 2AA9.tmp 1912 2AF7.tmp 2952 2B35.tmp 2724 2B83.tmp 2740 2BD1.tmp 2640 2C1F.tmp 1104 2C6D.tmp -
Loads dropped DLL 64 IoCs
pid Process 1656 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 1912 14E8.tmp 1880 1564.tmp 1224 1620.tmp 2744 16BC.tmp 2664 1729.tmp 2540 17C5.tmp 2272 1861.tmp 2636 18ED.tmp 2580 193B.tmp 2548 1999.tmp 1692 19E7.tmp 3052 1AA2.tmp 1716 1B2E.tmp 3020 1B8C.tmp 2044 1C38.tmp 2064 1CE3.tmp 1624 1D60.tmp 1580 1DEC.tmp 2508 1E98.tmp 2840 1F15.tmp 2964 1FB1.tmp 2156 202E.tmp 1368 206C.tmp 1544 20BA.tmp 1784 2108.tmp 2232 2146.tmp 2828 2194.tmp 2516 21E2.tmp 1088 2230.tmp 1112 226F.tmp 1924 22BD.tmp 604 22FB.tmp 788 2349.tmp 1052 2388.tmp 2140 23E5.tmp 1156 2433.tmp 804 2481.tmp 1968 24C0.tmp 1056 250E.tmp 2348 255C.tmp 2932 25AA.tmp 1824 25F8.tmp 1992 2636.tmp 1172 2674.tmp 272 26C2.tmp 2396 2710.tmp 2916 275E.tmp 1292 279D.tmp 2464 280A.tmp 1776 2858.tmp 2280 2896.tmp 2316 28E4.tmp 2192 2932.tmp 1984 2980.tmp 1412 29CE.tmp 1656 2A0D.tmp 1704 2A5B.tmp 2184 2AA9.tmp 1912 2AF7.tmp 2952 2B35.tmp 2724 2B83.tmp 2740 2BD1.tmp 2640 2C1F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1912 1656 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 28 PID 1656 wrote to memory of 1912 1656 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 28 PID 1656 wrote to memory of 1912 1656 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 28 PID 1656 wrote to memory of 1912 1656 2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe 28 PID 1912 wrote to memory of 1880 1912 14E8.tmp 29 PID 1912 wrote to memory of 1880 1912 14E8.tmp 29 PID 1912 wrote to memory of 1880 1912 14E8.tmp 29 PID 1912 wrote to memory of 1880 1912 14E8.tmp 29 PID 1880 wrote to memory of 1224 1880 1564.tmp 30 PID 1880 wrote to memory of 1224 1880 1564.tmp 30 PID 1880 wrote to memory of 1224 1880 1564.tmp 30 PID 1880 wrote to memory of 1224 1880 1564.tmp 30 PID 1224 wrote to memory of 2744 1224 1620.tmp 31 PID 1224 wrote to memory of 2744 1224 1620.tmp 31 PID 1224 wrote to memory of 2744 1224 1620.tmp 31 PID 1224 wrote to memory of 2744 1224 1620.tmp 31 PID 2744 wrote to memory of 2664 2744 16BC.tmp 32 PID 2744 wrote to memory of 2664 2744 16BC.tmp 32 PID 2744 wrote to memory of 2664 2744 16BC.tmp 32 PID 2744 wrote to memory of 2664 2744 16BC.tmp 32 PID 2664 wrote to memory of 2540 2664 1729.tmp 33 PID 2664 wrote to memory of 2540 2664 1729.tmp 33 PID 2664 wrote to memory of 2540 2664 1729.tmp 33 PID 2664 wrote to memory of 2540 2664 1729.tmp 33 PID 2540 wrote to memory of 2272 2540 17C5.tmp 34 PID 2540 wrote to memory of 2272 2540 17C5.tmp 34 PID 2540 wrote to memory of 2272 2540 17C5.tmp 34 PID 2540 wrote to memory of 2272 2540 17C5.tmp 34 PID 2272 wrote to memory of 2636 2272 1861.tmp 35 PID 2272 wrote to memory of 2636 2272 1861.tmp 35 PID 2272 wrote to memory of 2636 2272 1861.tmp 35 PID 2272 wrote to memory of 2636 2272 1861.tmp 35 PID 2636 wrote to memory of 2580 2636 18ED.tmp 36 PID 2636 wrote to memory of 2580 2636 18ED.tmp 36 PID 2636 wrote to memory of 2580 2636 18ED.tmp 36 PID 2636 wrote to memory of 2580 2636 18ED.tmp 36 PID 2580 wrote to memory of 2548 2580 193B.tmp 37 PID 2580 wrote to memory of 2548 2580 193B.tmp 37 PID 2580 wrote to memory of 2548 2580 193B.tmp 37 PID 2580 wrote to memory of 2548 2580 193B.tmp 37 PID 2548 wrote to memory of 1692 2548 1999.tmp 38 PID 2548 wrote to memory of 1692 2548 1999.tmp 38 PID 2548 wrote to memory of 1692 2548 1999.tmp 38 PID 2548 wrote to memory of 1692 2548 1999.tmp 38 PID 1692 wrote to memory of 3052 1692 19E7.tmp 39 PID 1692 wrote to memory of 3052 1692 19E7.tmp 39 PID 1692 wrote to memory of 3052 1692 19E7.tmp 39 PID 1692 wrote to memory of 3052 1692 19E7.tmp 39 PID 3052 wrote to memory of 1716 3052 1AA2.tmp 40 PID 3052 wrote to memory of 1716 3052 1AA2.tmp 40 PID 3052 wrote to memory of 1716 3052 1AA2.tmp 40 PID 3052 wrote to memory of 1716 3052 1AA2.tmp 40 PID 1716 wrote to memory of 3020 1716 1B2E.tmp 41 PID 1716 wrote to memory of 3020 1716 1B2E.tmp 41 PID 1716 wrote to memory of 3020 1716 1B2E.tmp 41 PID 1716 wrote to memory of 3020 1716 1B2E.tmp 41 PID 3020 wrote to memory of 2044 3020 1B8C.tmp 42 PID 3020 wrote to memory of 2044 3020 1B8C.tmp 42 PID 3020 wrote to memory of 2044 3020 1B8C.tmp 42 PID 3020 wrote to memory of 2044 3020 1B8C.tmp 42 PID 2044 wrote to memory of 2064 2044 1C38.tmp 43 PID 2044 wrote to memory of 2064 2044 1C38.tmp 43 PID 2044 wrote to memory of 2064 2044 1C38.tmp 43 PID 2044 wrote to memory of 2064 2044 1C38.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_78cb7cd7971ecbea3f59c3fd5a5f640c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"C:\Users\Admin\AppData\Local\Temp\1B8C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"65⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"66⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"69⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"70⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"71⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"72⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"73⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"74⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"75⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"76⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"77⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"78⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"79⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"80⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"81⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"82⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"83⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"84⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"85⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"86⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"88⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"89⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"90⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"91⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"92⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"93⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"94⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"95⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"96⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"97⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"98⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"99⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"100⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"101⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"102⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"103⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"104⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"105⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"106⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"107⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"108⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"109⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"110⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"111⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"112⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"113⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"114⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"115⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"116⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"117⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"118⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"120⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"121⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-