Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe
-
Size
536KB
-
MD5
f4f1b121d8e8b33c72f74eadc1796339
-
SHA1
80feea8d00ddf98f982b1e6abe702ae145010deb
-
SHA256
f7e33266ad8111402d2ac42690785c80b4bf07ff5402475c16250f992c4ad8c6
-
SHA512
8d9ed48cef6bc8be97a7c6288a6cab69cb8c4a5ca303fa67db5e55e5e440bd1e2a58955fced56c090cbe96447e57bad2fb88e4b6c37731933dc6e992118b2535
-
SSDEEP
12288:wU5rCOTeiUbWw787BBAtCBsXJd1juaXs5/IZxVJ0ZT9:wUQOJUz8MtCmHu3xIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2576 B76.tmp 2508 C02.tmp 2564 C8E.tmp 2716 D2A.tmp 2060 D88.tmp 2528 E24.tmp 2360 EB0.tmp 2796 F4C.tmp 1552 FD9.tmp 2340 1065.tmp 2680 1101.tmp 2700 117E.tmp 1016 11FB.tmp 284 12A6.tmp 1684 1323.tmp 1184 13B0.tmp 1228 143C.tmp 836 149A.tmp 1180 1507.tmp 2020 1593.tmp 2188 1610.tmp 768 169C.tmp 588 1729.tmp 848 1786.tmp 1564 17C5.tmp 1468 1813.tmp 2860 1880.tmp 2888 18CE.tmp 1676 191C.tmp 1928 196A.tmp 360 19C8.tmp 1256 1A25.tmp 1580 1A92.tmp 2192 1AD1.tmp 2300 1B2E.tmp 2228 1B6D.tmp 2148 1BAB.tmp 1432 1BEA.tmp 2152 1C38.tmp 1996 1C86.tmp 3032 1D12.tmp 2036 1D60.tmp 2492 1D9E.tmp 2520 1DEC.tmp 2480 1E3A.tmp 2064 1E98.tmp 1940 1F05.tmp 2476 1F44.tmp 2528 1F82.tmp 2376 1FD0.tmp 1712 201E.tmp 2796 205C.tmp 2352 209B.tmp 2660 20E9.tmp 2256 2137.tmp 2776 2175.tmp 2108 21B4.tmp 1612 21F2.tmp 1508 2230.tmp 1812 226F.tmp 1596 22BD.tmp 1184 22FB.tmp 1232 2349.tmp 2176 2388.tmp -
Loads dropped DLL 64 IoCs
pid Process 1904 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 2576 B76.tmp 2508 C02.tmp 2564 C8E.tmp 2716 D2A.tmp 2060 D88.tmp 2528 E24.tmp 2360 EB0.tmp 2796 F4C.tmp 1552 FD9.tmp 2340 1065.tmp 2680 1101.tmp 2700 117E.tmp 1016 11FB.tmp 284 12A6.tmp 1684 1323.tmp 1184 13B0.tmp 1228 143C.tmp 836 149A.tmp 1180 1507.tmp 2020 1593.tmp 2188 1610.tmp 768 169C.tmp 588 1729.tmp 848 1786.tmp 1564 17C5.tmp 1468 1813.tmp 2860 1880.tmp 2888 18CE.tmp 1676 191C.tmp 1928 196A.tmp 360 19C8.tmp 1256 1A25.tmp 1580 1A92.tmp 2192 1AD1.tmp 2300 1B2E.tmp 2228 1B6D.tmp 2148 1BAB.tmp 1432 1BEA.tmp 2152 1C38.tmp 2704 1CD4.tmp 3032 1D12.tmp 2036 1D60.tmp 2492 1D9E.tmp 2520 1DEC.tmp 2480 1E3A.tmp 2064 1E98.tmp 1940 1F05.tmp 2476 1F44.tmp 2528 1F82.tmp 2376 1FD0.tmp 1712 201E.tmp 2796 205C.tmp 2352 209B.tmp 2660 20E9.tmp 2256 2137.tmp 2776 2175.tmp 2108 21B4.tmp 1612 21F2.tmp 1508 2230.tmp 1812 226F.tmp 1596 22BD.tmp 1184 22FB.tmp 1232 2349.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 2576 1904 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 28 PID 1904 wrote to memory of 2576 1904 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 28 PID 1904 wrote to memory of 2576 1904 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 28 PID 1904 wrote to memory of 2576 1904 2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe 28 PID 2576 wrote to memory of 2508 2576 B76.tmp 29 PID 2576 wrote to memory of 2508 2576 B76.tmp 29 PID 2576 wrote to memory of 2508 2576 B76.tmp 29 PID 2576 wrote to memory of 2508 2576 B76.tmp 29 PID 2508 wrote to memory of 2564 2508 C02.tmp 30 PID 2508 wrote to memory of 2564 2508 C02.tmp 30 PID 2508 wrote to memory of 2564 2508 C02.tmp 30 PID 2508 wrote to memory of 2564 2508 C02.tmp 30 PID 2564 wrote to memory of 2716 2564 C8E.tmp 31 PID 2564 wrote to memory of 2716 2564 C8E.tmp 31 PID 2564 wrote to memory of 2716 2564 C8E.tmp 31 PID 2564 wrote to memory of 2716 2564 C8E.tmp 31 PID 2716 wrote to memory of 2060 2716 D2A.tmp 32 PID 2716 wrote to memory of 2060 2716 D2A.tmp 32 PID 2716 wrote to memory of 2060 2716 D2A.tmp 32 PID 2716 wrote to memory of 2060 2716 D2A.tmp 32 PID 2060 wrote to memory of 2528 2060 D88.tmp 33 PID 2060 wrote to memory of 2528 2060 D88.tmp 33 PID 2060 wrote to memory of 2528 2060 D88.tmp 33 PID 2060 wrote to memory of 2528 2060 D88.tmp 33 PID 2528 wrote to memory of 2360 2528 E24.tmp 34 PID 2528 wrote to memory of 2360 2528 E24.tmp 34 PID 2528 wrote to memory of 2360 2528 E24.tmp 34 PID 2528 wrote to memory of 2360 2528 E24.tmp 34 PID 2360 wrote to memory of 2796 2360 EB0.tmp 35 PID 2360 wrote to memory of 2796 2360 EB0.tmp 35 PID 2360 wrote to memory of 2796 2360 EB0.tmp 35 PID 2360 wrote to memory of 2796 2360 EB0.tmp 35 PID 2796 wrote to memory of 1552 2796 F4C.tmp 36 PID 2796 wrote to memory of 1552 2796 F4C.tmp 36 PID 2796 wrote to memory of 1552 2796 F4C.tmp 36 PID 2796 wrote to memory of 1552 2796 F4C.tmp 36 PID 1552 wrote to memory of 2340 1552 FD9.tmp 37 PID 1552 wrote to memory of 2340 1552 FD9.tmp 37 PID 1552 wrote to memory of 2340 1552 FD9.tmp 37 PID 1552 wrote to memory of 2340 1552 FD9.tmp 37 PID 2340 wrote to memory of 2680 2340 1065.tmp 38 PID 2340 wrote to memory of 2680 2340 1065.tmp 38 PID 2340 wrote to memory of 2680 2340 1065.tmp 38 PID 2340 wrote to memory of 2680 2340 1065.tmp 38 PID 2680 wrote to memory of 2700 2680 1101.tmp 39 PID 2680 wrote to memory of 2700 2680 1101.tmp 39 PID 2680 wrote to memory of 2700 2680 1101.tmp 39 PID 2680 wrote to memory of 2700 2680 1101.tmp 39 PID 2700 wrote to memory of 1016 2700 117E.tmp 40 PID 2700 wrote to memory of 1016 2700 117E.tmp 40 PID 2700 wrote to memory of 1016 2700 117E.tmp 40 PID 2700 wrote to memory of 1016 2700 117E.tmp 40 PID 1016 wrote to memory of 284 1016 11FB.tmp 41 PID 1016 wrote to memory of 284 1016 11FB.tmp 41 PID 1016 wrote to memory of 284 1016 11FB.tmp 41 PID 1016 wrote to memory of 284 1016 11FB.tmp 41 PID 284 wrote to memory of 1684 284 12A6.tmp 42 PID 284 wrote to memory of 1684 284 12A6.tmp 42 PID 284 wrote to memory of 1684 284 12A6.tmp 42 PID 284 wrote to memory of 1684 284 12A6.tmp 42 PID 1684 wrote to memory of 1184 1684 1323.tmp 43 PID 1684 wrote to memory of 1184 1684 1323.tmp 43 PID 1684 wrote to memory of 1184 1684 1323.tmp 43 PID 1684 wrote to memory of 1184 1684 1323.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-04_f4f1b121d8e8b33c72f74eadc1796339_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\11FB.tmp"C:\Users\Admin\AppData\Local\Temp\11FB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:284 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\1A92.tmp"C:\Users\Admin\AppData\Local\Temp\1A92.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"41⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"42⤵
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"66⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"67⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"68⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"69⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"70⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"71⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"72⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"73⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"74⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"75⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"76⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"77⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"78⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"79⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"80⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"81⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"82⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"83⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"84⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"85⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"86⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"87⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"88⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"89⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"90⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"91⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"92⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"93⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"94⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"95⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"96⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"97⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"98⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"99⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"100⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"101⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"102⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"103⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"104⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"105⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"106⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"107⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"108⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"109⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"110⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"111⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"112⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"113⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"114⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"115⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"116⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"117⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"118⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"119⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"120⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"121⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-