Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe
-
Size
527KB
-
MD5
de4c81872566ee040216b424d00f6cc8
-
SHA1
998552bb3330c70b2105ed29dc7640a53e4e0973
-
SHA256
dfd588d7b91c2bde09847516674469c90da966cfca7cc7ee8d9ba411d63b06eb
-
SHA512
648bdaaab233e15a124fc8f65070212807fd2e91012fcdc3347268ddf88f2f26ba0d0316b71ee6d3ccd4b82e6f8f5c34b3c544ef39525ebda372e39c5600b490
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYgX3m2dlEx1KPob8KQ0aWA/kd7Gx8WrQE7ltN:fU5rCOTeid9X22dGx1mTHSWJqJioDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2192 1FE0.tmp 2516 204D.tmp 2628 20CA.tmp 2784 2127.tmp 1940 2194.tmp 2252 21F2.tmp 2432 225F.tmp 2456 22BD.tmp 2440 231A.tmp 2880 2378.tmp 1596 23E5.tmp 2700 2443.tmp 2732 24A0.tmp 2836 24FE.tmp 1172 254C.tmp 284 25B9.tmp 1552 2626.tmp 2292 2674.tmp 1432 26E2.tmp 2656 273F.tmp 2216 279D.tmp 1280 27FA.tmp 2028 2848.tmp 2096 2887.tmp 2128 28C5.tmp 496 2904.tmp 2280 2942.tmp 2100 2980.tmp 1976 29BF.tmp 2256 29FD.tmp 592 2A4B.tmp 948 2A8A.tmp 2804 2AC8.tmp 2916 2B06.tmp 352 2B54.tmp 2172 2B93.tmp 412 2BD1.tmp 3012 2C10.tmp 2372 2C4E.tmp 1488 2C8C.tmp 1684 2CCB.tmp 1556 2D09.tmp 1236 2D48.tmp 2300 2D86.tmp 108 2DC4.tmp 1448 2E03.tmp 2968 2E41.tmp 1992 2E8F.tmp 1688 2ECE.tmp 2204 2F0C.tmp 2788 2F4A.tmp 2940 2F98.tmp 912 2FD7.tmp 2948 3015.tmp 1732 3054.tmp 1648 30A2.tmp 1920 30E0.tmp 2976 311E.tmp 2192 315D.tmp 3008 319B.tmp 2676 31DA.tmp 2672 3228.tmp 2416 3276.tmp 2568 32B4.tmp -
Loads dropped DLL 64 IoCs
pid Process 2020 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 2192 1FE0.tmp 2516 204D.tmp 2628 20CA.tmp 2784 2127.tmp 1940 2194.tmp 2252 21F2.tmp 2432 225F.tmp 2456 22BD.tmp 2440 231A.tmp 2880 2378.tmp 1596 23E5.tmp 2700 2443.tmp 2732 24A0.tmp 2836 24FE.tmp 1172 254C.tmp 284 25B9.tmp 1552 2626.tmp 2292 2674.tmp 1432 26E2.tmp 2656 273F.tmp 2216 279D.tmp 1280 27FA.tmp 2028 2848.tmp 2096 2887.tmp 2128 28C5.tmp 496 2904.tmp 2280 2942.tmp 2100 2980.tmp 1976 29BF.tmp 2256 29FD.tmp 592 2A4B.tmp 948 2A8A.tmp 2804 2AC8.tmp 2916 2B06.tmp 352 2B54.tmp 2172 2B93.tmp 412 2BD1.tmp 3012 2C10.tmp 2372 2C4E.tmp 1488 2C8C.tmp 1684 2CCB.tmp 1556 2D09.tmp 1236 2D48.tmp 2300 2D86.tmp 108 2DC4.tmp 1448 2E03.tmp 2968 2E41.tmp 1992 2E8F.tmp 1688 2ECE.tmp 2204 2F0C.tmp 2788 2F4A.tmp 2940 2F98.tmp 912 2FD7.tmp 2948 3015.tmp 1732 3054.tmp 1648 30A2.tmp 1920 30E0.tmp 2976 311E.tmp 2192 315D.tmp 3008 319B.tmp 2676 31DA.tmp 2672 3228.tmp 2416 3276.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2192 2020 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 28 PID 2020 wrote to memory of 2192 2020 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 28 PID 2020 wrote to memory of 2192 2020 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 28 PID 2020 wrote to memory of 2192 2020 2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe 28 PID 2192 wrote to memory of 2516 2192 1FE0.tmp 29 PID 2192 wrote to memory of 2516 2192 1FE0.tmp 29 PID 2192 wrote to memory of 2516 2192 1FE0.tmp 29 PID 2192 wrote to memory of 2516 2192 1FE0.tmp 29 PID 2516 wrote to memory of 2628 2516 204D.tmp 30 PID 2516 wrote to memory of 2628 2516 204D.tmp 30 PID 2516 wrote to memory of 2628 2516 204D.tmp 30 PID 2516 wrote to memory of 2628 2516 204D.tmp 30 PID 2628 wrote to memory of 2784 2628 20CA.tmp 31 PID 2628 wrote to memory of 2784 2628 20CA.tmp 31 PID 2628 wrote to memory of 2784 2628 20CA.tmp 31 PID 2628 wrote to memory of 2784 2628 20CA.tmp 31 PID 2784 wrote to memory of 1940 2784 2127.tmp 32 PID 2784 wrote to memory of 1940 2784 2127.tmp 32 PID 2784 wrote to memory of 1940 2784 2127.tmp 32 PID 2784 wrote to memory of 1940 2784 2127.tmp 32 PID 1940 wrote to memory of 2252 1940 2194.tmp 33 PID 1940 wrote to memory of 2252 1940 2194.tmp 33 PID 1940 wrote to memory of 2252 1940 2194.tmp 33 PID 1940 wrote to memory of 2252 1940 2194.tmp 33 PID 2252 wrote to memory of 2432 2252 21F2.tmp 34 PID 2252 wrote to memory of 2432 2252 21F2.tmp 34 PID 2252 wrote to memory of 2432 2252 21F2.tmp 34 PID 2252 wrote to memory of 2432 2252 21F2.tmp 34 PID 2432 wrote to memory of 2456 2432 225F.tmp 35 PID 2432 wrote to memory of 2456 2432 225F.tmp 35 PID 2432 wrote to memory of 2456 2432 225F.tmp 35 PID 2432 wrote to memory of 2456 2432 225F.tmp 35 PID 2456 wrote to memory of 2440 2456 22BD.tmp 36 PID 2456 wrote to memory of 2440 2456 22BD.tmp 36 PID 2456 wrote to memory of 2440 2456 22BD.tmp 36 PID 2456 wrote to memory of 2440 2456 22BD.tmp 36 PID 2440 wrote to memory of 2880 2440 231A.tmp 37 PID 2440 wrote to memory of 2880 2440 231A.tmp 37 PID 2440 wrote to memory of 2880 2440 231A.tmp 37 PID 2440 wrote to memory of 2880 2440 231A.tmp 37 PID 2880 wrote to memory of 1596 2880 2378.tmp 38 PID 2880 wrote to memory of 1596 2880 2378.tmp 38 PID 2880 wrote to memory of 1596 2880 2378.tmp 38 PID 2880 wrote to memory of 1596 2880 2378.tmp 38 PID 1596 wrote to memory of 2700 1596 23E5.tmp 39 PID 1596 wrote to memory of 2700 1596 23E5.tmp 39 PID 1596 wrote to memory of 2700 1596 23E5.tmp 39 PID 1596 wrote to memory of 2700 1596 23E5.tmp 39 PID 2700 wrote to memory of 2732 2700 2443.tmp 40 PID 2700 wrote to memory of 2732 2700 2443.tmp 40 PID 2700 wrote to memory of 2732 2700 2443.tmp 40 PID 2700 wrote to memory of 2732 2700 2443.tmp 40 PID 2732 wrote to memory of 2836 2732 24A0.tmp 41 PID 2732 wrote to memory of 2836 2732 24A0.tmp 41 PID 2732 wrote to memory of 2836 2732 24A0.tmp 41 PID 2732 wrote to memory of 2836 2732 24A0.tmp 41 PID 2836 wrote to memory of 1172 2836 24FE.tmp 42 PID 2836 wrote to memory of 1172 2836 24FE.tmp 42 PID 2836 wrote to memory of 1172 2836 24FE.tmp 42 PID 2836 wrote to memory of 1172 2836 24FE.tmp 42 PID 1172 wrote to memory of 284 1172 254C.tmp 43 PID 1172 wrote to memory of 284 1172 254C.tmp 43 PID 1172 wrote to memory of 284 1172 254C.tmp 43 PID 1172 wrote to memory of 284 1172 254C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_de4c81872566ee040216b424d00f6cc8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\204D.tmp"C:\Users\Admin\AppData\Local\Temp\204D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"65⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"66⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"67⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"69⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"70⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"71⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"72⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"73⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"74⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"75⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"76⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"79⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"80⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"81⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"82⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"83⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"84⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"85⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"86⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"87⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"88⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"89⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"90⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"91⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"92⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"93⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"94⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"95⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"96⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"97⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"98⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"99⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"100⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"101⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"102⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"103⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"104⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"105⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"106⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"C:\Users\Admin\AppData\Local\Temp\3D3F.tmp"107⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"108⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"109⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"110⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"111⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"112⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"113⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"114⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"115⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"116⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"117⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"118⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"119⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"120⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"121⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-