Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 13:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe
-
Size
536KB
-
MD5
d349e75acac107f71e1d27d31beb2cad
-
SHA1
8df0c1b34914195d3efad615f0b136536772f6c9
-
SHA256
d66c29559b4224d8240825b8dca9f26b6f56aa6cde58b291e43dd6f5eed42bd9
-
SHA512
df41f042deda6a029e2afe5d816862266232cb63ac5e22cb554ccf7f05aab6844cbeea669e026b10fb84e9c3b833ee1466d69f1d4b50cb805b8e2e36e095f2b8
-
SSDEEP
12288:wU5rCOTeiU6HMDXx9xJjBEjLIURIpzNrf56cdLIZxVJ0ZT9:wUQOJUXXTjBGLL2zNrUIIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2096 FE4C.tmp 3024 FED8.tmp 2628 FF94.tmp 2160 FFF1.tmp 2640 6E.tmp 2396 EB.tmp 2368 177.tmp 2888 1E4.tmp 752 280.tmp 2608 31C.tmp 2680 399.tmp 1608 3F7.tmp 304 464.tmp 2260 4D1.tmp 816 55E.tmp 1264 5DA.tmp 2032 638.tmp 2016 6C4.tmp 2760 741.tmp 2000 7CE.tmp 1748 86A.tmp 684 8C7.tmp 800 963.tmp 2712 9B1.tmp 568 9FF.tmp 1560 A6C.tmp 3044 ACA.tmp 412 B28.tmp 2980 B76.tmp 1548 BB4.tmp 812 C02.tmp 472 C50.tmp 108 CAE.tmp 2316 CFC.tmp 1616 D4A.tmp 856 DA7.tmp 1556 E05.tmp 1752 E62.tmp 1436 EB0.tmp 1656 EFE.tmp 1532 F4C.tmp 2784 FBA.tmp 2148 1008.tmp 2548 1056.tmp 2624 1094.tmp 2496 10D2.tmp 2388 1130.tmp 2928 118E.tmp 2640 11DC.tmp 2408 122A.tmp 2472 1278.tmp 2368 12C6.tmp 1464 1314.tmp 2340 1362.tmp 2572 13A0.tmp 2596 13DE.tmp 2252 141D.tmp 2248 146B.tmp 1584 14A9.tmp 288 14E8.tmp 2080 1526.tmp 1520 1564.tmp 2108 15B2.tmp 2104 1600.tmp -
Loads dropped DLL 64 IoCs
pid Process 2280 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 2096 FE4C.tmp 3024 FED8.tmp 2628 FF94.tmp 2160 FFF1.tmp 2640 6E.tmp 2396 EB.tmp 2368 177.tmp 2888 1E4.tmp 752 280.tmp 2608 31C.tmp 2680 399.tmp 1608 3F7.tmp 304 464.tmp 2260 4D1.tmp 816 55E.tmp 1264 5DA.tmp 2032 638.tmp 2016 6C4.tmp 2760 741.tmp 2000 7CE.tmp 1748 86A.tmp 684 8C7.tmp 800 963.tmp 2712 9B1.tmp 568 9FF.tmp 1560 A6C.tmp 3044 ACA.tmp 412 B28.tmp 2980 B76.tmp 1548 BB4.tmp 812 C02.tmp 472 C50.tmp 108 CAE.tmp 2316 CFC.tmp 1616 D4A.tmp 856 DA7.tmp 1556 E05.tmp 1752 E62.tmp 1436 EB0.tmp 1656 EFE.tmp 1532 F4C.tmp 2784 FBA.tmp 2148 1008.tmp 2548 1056.tmp 2624 1094.tmp 2496 10D2.tmp 2388 1130.tmp 2928 118E.tmp 2640 11DC.tmp 2408 122A.tmp 2472 1278.tmp 2368 12C6.tmp 1464 1314.tmp 2340 1362.tmp 2572 13A0.tmp 2596 13DE.tmp 2252 141D.tmp 2248 146B.tmp 1584 14A9.tmp 288 14E8.tmp 2080 1526.tmp 1520 1564.tmp 2108 15B2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2096 2280 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 28 PID 2280 wrote to memory of 2096 2280 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 28 PID 2280 wrote to memory of 2096 2280 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 28 PID 2280 wrote to memory of 2096 2280 2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe 28 PID 2096 wrote to memory of 3024 2096 FE4C.tmp 29 PID 2096 wrote to memory of 3024 2096 FE4C.tmp 29 PID 2096 wrote to memory of 3024 2096 FE4C.tmp 29 PID 2096 wrote to memory of 3024 2096 FE4C.tmp 29 PID 3024 wrote to memory of 2628 3024 FED8.tmp 30 PID 3024 wrote to memory of 2628 3024 FED8.tmp 30 PID 3024 wrote to memory of 2628 3024 FED8.tmp 30 PID 3024 wrote to memory of 2628 3024 FED8.tmp 30 PID 2628 wrote to memory of 2160 2628 FF94.tmp 31 PID 2628 wrote to memory of 2160 2628 FF94.tmp 31 PID 2628 wrote to memory of 2160 2628 FF94.tmp 31 PID 2628 wrote to memory of 2160 2628 FF94.tmp 31 PID 2160 wrote to memory of 2640 2160 FFF1.tmp 32 PID 2160 wrote to memory of 2640 2160 FFF1.tmp 32 PID 2160 wrote to memory of 2640 2160 FFF1.tmp 32 PID 2160 wrote to memory of 2640 2160 FFF1.tmp 32 PID 2640 wrote to memory of 2396 2640 6E.tmp 33 PID 2640 wrote to memory of 2396 2640 6E.tmp 33 PID 2640 wrote to memory of 2396 2640 6E.tmp 33 PID 2640 wrote to memory of 2396 2640 6E.tmp 33 PID 2396 wrote to memory of 2368 2396 EB.tmp 34 PID 2396 wrote to memory of 2368 2396 EB.tmp 34 PID 2396 wrote to memory of 2368 2396 EB.tmp 34 PID 2396 wrote to memory of 2368 2396 EB.tmp 34 PID 2368 wrote to memory of 2888 2368 177.tmp 35 PID 2368 wrote to memory of 2888 2368 177.tmp 35 PID 2368 wrote to memory of 2888 2368 177.tmp 35 PID 2368 wrote to memory of 2888 2368 177.tmp 35 PID 2888 wrote to memory of 752 2888 1E4.tmp 36 PID 2888 wrote to memory of 752 2888 1E4.tmp 36 PID 2888 wrote to memory of 752 2888 1E4.tmp 36 PID 2888 wrote to memory of 752 2888 1E4.tmp 36 PID 752 wrote to memory of 2608 752 280.tmp 37 PID 752 wrote to memory of 2608 752 280.tmp 37 PID 752 wrote to memory of 2608 752 280.tmp 37 PID 752 wrote to memory of 2608 752 280.tmp 37 PID 2608 wrote to memory of 2680 2608 31C.tmp 38 PID 2608 wrote to memory of 2680 2608 31C.tmp 38 PID 2608 wrote to memory of 2680 2608 31C.tmp 38 PID 2608 wrote to memory of 2680 2608 31C.tmp 38 PID 2680 wrote to memory of 1608 2680 399.tmp 39 PID 2680 wrote to memory of 1608 2680 399.tmp 39 PID 2680 wrote to memory of 1608 2680 399.tmp 39 PID 2680 wrote to memory of 1608 2680 399.tmp 39 PID 1608 wrote to memory of 304 1608 3F7.tmp 40 PID 1608 wrote to memory of 304 1608 3F7.tmp 40 PID 1608 wrote to memory of 304 1608 3F7.tmp 40 PID 1608 wrote to memory of 304 1608 3F7.tmp 40 PID 304 wrote to memory of 2260 304 464.tmp 41 PID 304 wrote to memory of 2260 304 464.tmp 41 PID 304 wrote to memory of 2260 304 464.tmp 41 PID 304 wrote to memory of 2260 304 464.tmp 41 PID 2260 wrote to memory of 816 2260 4D1.tmp 42 PID 2260 wrote to memory of 816 2260 4D1.tmp 42 PID 2260 wrote to memory of 816 2260 4D1.tmp 42 PID 2260 wrote to memory of 816 2260 4D1.tmp 42 PID 816 wrote to memory of 1264 816 55E.tmp 43 PID 816 wrote to memory of 1264 816 55E.tmp 43 PID 816 wrote to memory of 1264 816 55E.tmp 43 PID 816 wrote to memory of 1264 816 55E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-03_d349e75acac107f71e1d27d31beb2cad_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1E4.tmp"C:\Users\Admin\AppData\Local\Temp\1E4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\464.tmp"C:\Users\Admin\AppData\Local\Temp\464.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\4D1.tmp"C:\Users\Admin\AppData\Local\Temp\4D1.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\5DA.tmp"C:\Users\Admin\AppData\Local\Temp\5DA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\86A.tmp"C:\Users\Admin\AppData\Local\Temp\86A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\9B1.tmp"C:\Users\Admin\AppData\Local\Temp\9B1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B28.tmp"C:\Users\Admin\AppData\Local\Temp\B28.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\BB4.tmp"C:\Users\Admin\AppData\Local\Temp\BB4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\CAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\122A.tmp"C:\Users\Admin\AppData\Local\Temp\122A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"65⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"66⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"67⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"68⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"69⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"70⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"71⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"72⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"73⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"74⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"75⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"76⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"77⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"78⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"79⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"80⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"81⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"82⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"83⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"84⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"85⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"87⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\1C09.tmp"C:\Users\Admin\AppData\Local\Temp\1C09.tmp"88⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\1C47.tmp"C:\Users\Admin\AppData\Local\Temp\1C47.tmp"89⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"90⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"91⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"92⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"93⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"94⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"95⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"96⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"97⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"98⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"99⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"100⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"102⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"103⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"104⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"105⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"107⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"108⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"109⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"110⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"111⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"112⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"113⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"114⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"115⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"116⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"117⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"118⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"119⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"120⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"121⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-