Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 07:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe
-
Size
520KB
-
MD5
98d5f3cf3555011fb047bb308ee94ad9
-
SHA1
174ed6a4ed493813155442b2d740fe37217da0b8
-
SHA256
a80652e13341342841a3a67ace307bb0a422d42cf19816ed68b617ae531df4c1
-
SHA512
493b748e246a6a6df737b0bc59351542d92d2672353aee01cc53a2dad5b5f14452e3cf6ea7ce4e5af1a8b707d01b542e814e7c26502569c522503a7dc44fc6ee
-
SSDEEP
12288:gj8fuxR21t5i8fcWW4TTBnzOaiQ9tTbLhCD8LQxCXNZ:gj8fuK1GYcWFTTBzOaiAC8LQxCXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 752 B85.tmp 1524 BF2.tmp 3024 C7F.tmp 2636 CFC.tmp 2704 D69.tmp 2632 DE6.tmp 3036 E53.tmp 2524 EC0.tmp 2732 F2D.tmp 2172 F7B.tmp 2552 FE8.tmp 2984 1046.tmp 1896 10B3.tmp 2672 1101.tmp 2812 115F.tmp 2940 11BC.tmp 808 122A.tmp 1056 1287.tmp 2024 12F4.tmp 2044 1352.tmp 1760 13BF.tmp 884 142C.tmp 1672 147A.tmp 1668 14B9.tmp 1120 14F7.tmp 2060 1536.tmp 2192 1584.tmp 1532 15C2.tmp 2900 1600.tmp 2472 163F.tmp 2232 167D.tmp 484 16BC.tmp 1040 16FA.tmp 640 1738.tmp 812 1777.tmp 524 17C5.tmp 632 1803.tmp 832 1842.tmp 348 1880.tmp 2108 18BE.tmp 1748 18FD.tmp 308 193B.tmp 1396 197A.tmp 940 19B8.tmp 2912 19F6.tmp 1644 1A35.tmp 2220 1A73.tmp 2908 1AB2.tmp 2268 1AF0.tmp 568 1B2E.tmp 2928 1B6D.tmp 3048 1BAB.tmp 892 1BEA.tmp 3004 1C28.tmp 2932 1C66.tmp 2400 1D02.tmp 2416 1D41.tmp 2976 1D7F.tmp 2572 1DBE.tmp 3040 1DFC.tmp 2688 1E3A.tmp 3020 1E98.tmp 2684 1EE6.tmp 2756 1F24.tmp -
Loads dropped DLL 64 IoCs
pid Process 2412 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 752 B85.tmp 1524 BF2.tmp 3024 C7F.tmp 2636 CFC.tmp 2704 D69.tmp 2632 DE6.tmp 3036 E53.tmp 2524 EC0.tmp 2732 F2D.tmp 2172 F7B.tmp 2552 FE8.tmp 2984 1046.tmp 1896 10B3.tmp 2672 1101.tmp 2812 115F.tmp 2940 11BC.tmp 808 122A.tmp 1056 1287.tmp 2024 12F4.tmp 2044 1352.tmp 1760 13BF.tmp 884 142C.tmp 1672 147A.tmp 1668 14B9.tmp 1120 14F7.tmp 2060 1536.tmp 2192 1584.tmp 1532 15C2.tmp 2900 1600.tmp 2472 163F.tmp 2232 167D.tmp 484 16BC.tmp 1040 16FA.tmp 640 1738.tmp 812 1777.tmp 524 17C5.tmp 632 1803.tmp 832 1842.tmp 348 1880.tmp 2108 18BE.tmp 1748 18FD.tmp 308 193B.tmp 1396 197A.tmp 940 19B8.tmp 2912 19F6.tmp 1644 1A35.tmp 2220 1A73.tmp 2908 1AB2.tmp 2268 1AF0.tmp 568 1B2E.tmp 2928 1B6D.tmp 3048 1BAB.tmp 892 1BEA.tmp 3004 1C28.tmp 1600 1CA5.tmp 2400 1D02.tmp 2416 1D41.tmp 2976 1D7F.tmp 2572 1DBE.tmp 3040 1DFC.tmp 2688 1E3A.tmp 3020 1E98.tmp 2684 1EE6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 752 2412 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 28 PID 2412 wrote to memory of 752 2412 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 28 PID 2412 wrote to memory of 752 2412 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 28 PID 2412 wrote to memory of 752 2412 2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe 28 PID 752 wrote to memory of 1524 752 B85.tmp 29 PID 752 wrote to memory of 1524 752 B85.tmp 29 PID 752 wrote to memory of 1524 752 B85.tmp 29 PID 752 wrote to memory of 1524 752 B85.tmp 29 PID 1524 wrote to memory of 3024 1524 BF2.tmp 30 PID 1524 wrote to memory of 3024 1524 BF2.tmp 30 PID 1524 wrote to memory of 3024 1524 BF2.tmp 30 PID 1524 wrote to memory of 3024 1524 BF2.tmp 30 PID 3024 wrote to memory of 2636 3024 C7F.tmp 31 PID 3024 wrote to memory of 2636 3024 C7F.tmp 31 PID 3024 wrote to memory of 2636 3024 C7F.tmp 31 PID 3024 wrote to memory of 2636 3024 C7F.tmp 31 PID 2636 wrote to memory of 2704 2636 CFC.tmp 32 PID 2636 wrote to memory of 2704 2636 CFC.tmp 32 PID 2636 wrote to memory of 2704 2636 CFC.tmp 32 PID 2636 wrote to memory of 2704 2636 CFC.tmp 32 PID 2704 wrote to memory of 2632 2704 D69.tmp 33 PID 2704 wrote to memory of 2632 2704 D69.tmp 33 PID 2704 wrote to memory of 2632 2704 D69.tmp 33 PID 2704 wrote to memory of 2632 2704 D69.tmp 33 PID 2632 wrote to memory of 3036 2632 DE6.tmp 34 PID 2632 wrote to memory of 3036 2632 DE6.tmp 34 PID 2632 wrote to memory of 3036 2632 DE6.tmp 34 PID 2632 wrote to memory of 3036 2632 DE6.tmp 34 PID 3036 wrote to memory of 2524 3036 E53.tmp 35 PID 3036 wrote to memory of 2524 3036 E53.tmp 35 PID 3036 wrote to memory of 2524 3036 E53.tmp 35 PID 3036 wrote to memory of 2524 3036 E53.tmp 35 PID 2524 wrote to memory of 2732 2524 EC0.tmp 36 PID 2524 wrote to memory of 2732 2524 EC0.tmp 36 PID 2524 wrote to memory of 2732 2524 EC0.tmp 36 PID 2524 wrote to memory of 2732 2524 EC0.tmp 36 PID 2732 wrote to memory of 2172 2732 F2D.tmp 37 PID 2732 wrote to memory of 2172 2732 F2D.tmp 37 PID 2732 wrote to memory of 2172 2732 F2D.tmp 37 PID 2732 wrote to memory of 2172 2732 F2D.tmp 37 PID 2172 wrote to memory of 2552 2172 F7B.tmp 38 PID 2172 wrote to memory of 2552 2172 F7B.tmp 38 PID 2172 wrote to memory of 2552 2172 F7B.tmp 38 PID 2172 wrote to memory of 2552 2172 F7B.tmp 38 PID 2552 wrote to memory of 2984 2552 FE8.tmp 39 PID 2552 wrote to memory of 2984 2552 FE8.tmp 39 PID 2552 wrote to memory of 2984 2552 FE8.tmp 39 PID 2552 wrote to memory of 2984 2552 FE8.tmp 39 PID 2984 wrote to memory of 1896 2984 1046.tmp 40 PID 2984 wrote to memory of 1896 2984 1046.tmp 40 PID 2984 wrote to memory of 1896 2984 1046.tmp 40 PID 2984 wrote to memory of 1896 2984 1046.tmp 40 PID 1896 wrote to memory of 2672 1896 10B3.tmp 41 PID 1896 wrote to memory of 2672 1896 10B3.tmp 41 PID 1896 wrote to memory of 2672 1896 10B3.tmp 41 PID 1896 wrote to memory of 2672 1896 10B3.tmp 41 PID 2672 wrote to memory of 2812 2672 1101.tmp 42 PID 2672 wrote to memory of 2812 2672 1101.tmp 42 PID 2672 wrote to memory of 2812 2672 1101.tmp 42 PID 2672 wrote to memory of 2812 2672 1101.tmp 42 PID 2812 wrote to memory of 2940 2812 115F.tmp 43 PID 2812 wrote to memory of 2940 2812 115F.tmp 43 PID 2812 wrote to memory of 2940 2812 115F.tmp 43 PID 2812 wrote to memory of 2940 2812 115F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_98d5f3cf3555011fb047bb308ee94ad9_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\B85.tmp"C:\Users\Admin\AppData\Local\Temp\B85.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\C7F.tmp"C:\Users\Admin\AppData\Local\Temp\C7F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F2D.tmp"C:\Users\Admin\AppData\Local\Temp\F2D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1046.tmp"C:\Users\Admin\AppData\Local\Temp\1046.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\10B3.tmp"C:\Users\Admin\AppData\Local\Temp\10B3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\167D.tmp"C:\Users\Admin\AppData\Local\Temp\167D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\197A.tmp"C:\Users\Admin\AppData\Local\Temp\197A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\19F6.tmp"C:\Users\Admin\AppData\Local\Temp\19F6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"56⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"57⤵
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"66⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"67⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"68⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"69⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"70⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"72⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"73⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"74⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"75⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"76⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"77⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"78⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"80⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"81⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"82⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"83⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"84⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"85⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"86⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"87⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"88⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"89⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"90⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"91⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"92⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"94⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\2636.tmp"C:\Users\Admin\AppData\Local\Temp\2636.tmp"95⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"96⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"97⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"98⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"99⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"100⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"101⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"103⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"104⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"105⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"106⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"107⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"108⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"109⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"110⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"111⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"112⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"113⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"114⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"115⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"116⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"117⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"118⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"119⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"120⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"121⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-