Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe
-
Size
765KB
-
MD5
9f0b73d98aef1e1e793a149067d1bcbb
-
SHA1
8bc0d74183ff9c25cacf7e61ed9ddaa28c9ede41
-
SHA256
be19fac27ea2b85ab5a725905d673ea3c95ce79942bd656fb7caa3c9983bf7b2
-
SHA512
202092f0d2af9e19039d744b5516e3742a31b6e78ebbabcc6a90f343ff8ab2dca9e47a6cb6c32c08c3c94fe5f4ce38b3724c51b92dfa0b1ee9dc049197b83b7a
-
SSDEEP
12288:ZU5rCOTeiD5Fs3pvfiU3iz/aPEmAtekO3ZF5rn5rLOa54U5w5A:ZUQOJDfspSU3rPLAte/3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2128 2701.tmp 2892 274F.tmp 2852 27AC.tmp 1620 280A.tmp 2652 2858.tmp 2564 28C5.tmp 2928 2913.tmp 2472 2971.tmp 2608 29DE.tmp 2936 2A4B.tmp 2500 2AA9.tmp 2860 2B26.tmp 2372 2B83.tmp 1660 2BD1.tmp 772 2C3E.tmp 1768 2CBB.tmp 2424 2D09.tmp 1056 2D86.tmp 1308 2E03.tmp 2200 2E80.tmp 1956 2EED.tmp 600 2F2B.tmp 448 2FC7.tmp 592 3006.tmp 2336 3044.tmp 284 3082.tmp 1712 30C1.tmp 1776 30FF.tmp 2748 313E.tmp 2612 317C.tmp 2312 31BA.tmp 2628 31F9.tmp 2416 3237.tmp 2068 3276.tmp 1864 32B4.tmp 2912 32F2.tmp 1820 3331.tmp 804 336F.tmp 1696 33AE.tmp 2972 33FC.tmp 1812 343A.tmp 1784 3498.tmp 2224 34D6.tmp 776 3514.tmp 2908 3553.tmp 1792 35A1.tmp 944 35DF.tmp 3036 361E.tmp 636 365C.tmp 360 369A.tmp 1728 36D9.tmp 1772 3717.tmp 1640 3756.tmp 2076 37A4.tmp 2732 37E2.tmp 2764 3820.tmp 2840 385F.tmp 2128 389D.tmp 2740 38EB.tmp 2920 392A.tmp 2060 3968.tmp 2644 39A6.tmp 2660 39E5.tmp 2636 3A33.tmp -
Loads dropped DLL 64 IoCs
pid Process 1744 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 2128 2701.tmp 2892 274F.tmp 2852 27AC.tmp 1620 280A.tmp 2652 2858.tmp 2564 28C5.tmp 2928 2913.tmp 2472 2971.tmp 2608 29DE.tmp 2936 2A4B.tmp 2500 2AA9.tmp 2860 2B26.tmp 2372 2B83.tmp 1660 2BD1.tmp 772 2C3E.tmp 1768 2CBB.tmp 2424 2D09.tmp 1056 2D86.tmp 1308 2E03.tmp 2200 2E80.tmp 1956 2EED.tmp 600 2F2B.tmp 448 2FC7.tmp 592 3006.tmp 2336 3044.tmp 284 3082.tmp 1712 30C1.tmp 1776 30FF.tmp 2748 313E.tmp 2612 317C.tmp 2312 31BA.tmp 2628 31F9.tmp 2416 3237.tmp 2068 3276.tmp 1864 32B4.tmp 2912 32F2.tmp 1820 3331.tmp 804 336F.tmp 1696 33AE.tmp 2972 33FC.tmp 1812 343A.tmp 1784 3498.tmp 2224 34D6.tmp 776 3514.tmp 2908 3553.tmp 1792 35A1.tmp 944 35DF.tmp 3036 361E.tmp 636 365C.tmp 360 369A.tmp 1728 36D9.tmp 1772 3717.tmp 1640 3756.tmp 2076 37A4.tmp 2732 37E2.tmp 2764 3820.tmp 2840 385F.tmp 2128 389D.tmp 2740 38EB.tmp 2920 392A.tmp 2060 3968.tmp 2644 39A6.tmp 2660 39E5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1744 wrote to memory of 2128 1744 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 28 PID 1744 wrote to memory of 2128 1744 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 28 PID 1744 wrote to memory of 2128 1744 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 28 PID 1744 wrote to memory of 2128 1744 2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe 28 PID 2128 wrote to memory of 2892 2128 2701.tmp 29 PID 2128 wrote to memory of 2892 2128 2701.tmp 29 PID 2128 wrote to memory of 2892 2128 2701.tmp 29 PID 2128 wrote to memory of 2892 2128 2701.tmp 29 PID 2892 wrote to memory of 2852 2892 274F.tmp 30 PID 2892 wrote to memory of 2852 2892 274F.tmp 30 PID 2892 wrote to memory of 2852 2892 274F.tmp 30 PID 2892 wrote to memory of 2852 2892 274F.tmp 30 PID 2852 wrote to memory of 1620 2852 27AC.tmp 31 PID 2852 wrote to memory of 1620 2852 27AC.tmp 31 PID 2852 wrote to memory of 1620 2852 27AC.tmp 31 PID 2852 wrote to memory of 1620 2852 27AC.tmp 31 PID 1620 wrote to memory of 2652 1620 280A.tmp 32 PID 1620 wrote to memory of 2652 1620 280A.tmp 32 PID 1620 wrote to memory of 2652 1620 280A.tmp 32 PID 1620 wrote to memory of 2652 1620 280A.tmp 32 PID 2652 wrote to memory of 2564 2652 2858.tmp 33 PID 2652 wrote to memory of 2564 2652 2858.tmp 33 PID 2652 wrote to memory of 2564 2652 2858.tmp 33 PID 2652 wrote to memory of 2564 2652 2858.tmp 33 PID 2564 wrote to memory of 2928 2564 28C5.tmp 34 PID 2564 wrote to memory of 2928 2564 28C5.tmp 34 PID 2564 wrote to memory of 2928 2564 28C5.tmp 34 PID 2564 wrote to memory of 2928 2564 28C5.tmp 34 PID 2928 wrote to memory of 2472 2928 2913.tmp 35 PID 2928 wrote to memory of 2472 2928 2913.tmp 35 PID 2928 wrote to memory of 2472 2928 2913.tmp 35 PID 2928 wrote to memory of 2472 2928 2913.tmp 35 PID 2472 wrote to memory of 2608 2472 2971.tmp 36 PID 2472 wrote to memory of 2608 2472 2971.tmp 36 PID 2472 wrote to memory of 2608 2472 2971.tmp 36 PID 2472 wrote to memory of 2608 2472 2971.tmp 36 PID 2608 wrote to memory of 2936 2608 29DE.tmp 37 PID 2608 wrote to memory of 2936 2608 29DE.tmp 37 PID 2608 wrote to memory of 2936 2608 29DE.tmp 37 PID 2608 wrote to memory of 2936 2608 29DE.tmp 37 PID 2936 wrote to memory of 2500 2936 2A4B.tmp 38 PID 2936 wrote to memory of 2500 2936 2A4B.tmp 38 PID 2936 wrote to memory of 2500 2936 2A4B.tmp 38 PID 2936 wrote to memory of 2500 2936 2A4B.tmp 38 PID 2500 wrote to memory of 2860 2500 2AA9.tmp 39 PID 2500 wrote to memory of 2860 2500 2AA9.tmp 39 PID 2500 wrote to memory of 2860 2500 2AA9.tmp 39 PID 2500 wrote to memory of 2860 2500 2AA9.tmp 39 PID 2860 wrote to memory of 2372 2860 2B26.tmp 40 PID 2860 wrote to memory of 2372 2860 2B26.tmp 40 PID 2860 wrote to memory of 2372 2860 2B26.tmp 40 PID 2860 wrote to memory of 2372 2860 2B26.tmp 40 PID 2372 wrote to memory of 1660 2372 2B83.tmp 41 PID 2372 wrote to memory of 1660 2372 2B83.tmp 41 PID 2372 wrote to memory of 1660 2372 2B83.tmp 41 PID 2372 wrote to memory of 1660 2372 2B83.tmp 41 PID 1660 wrote to memory of 772 1660 2BD1.tmp 42 PID 1660 wrote to memory of 772 1660 2BD1.tmp 42 PID 1660 wrote to memory of 772 1660 2BD1.tmp 42 PID 1660 wrote to memory of 772 1660 2BD1.tmp 42 PID 772 wrote to memory of 1768 772 2C3E.tmp 43 PID 772 wrote to memory of 1768 772 2C3E.tmp 43 PID 772 wrote to memory of 1768 772 2C3E.tmp 43 PID 772 wrote to memory of 1768 772 2C3E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_9f0b73d98aef1e1e793a149067d1bcbb_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:360 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"66⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"67⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"70⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"71⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"C:\Users\Admin\AppData\Local\Temp\3BF7.tmp"72⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"73⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"74⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"75⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"76⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"77⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"78⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"79⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"80⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"81⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"82⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"83⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"84⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"85⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"86⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"87⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"88⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"89⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"90⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"91⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"92⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"93⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"94⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"95⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"96⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"97⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"98⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"99⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"100⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"101⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"102⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"103⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"104⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"105⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"106⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"107⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"108⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"109⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"110⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"111⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"112⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"113⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"114⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"115⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"116⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"117⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"118⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"119⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"120⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"121⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"122⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-