Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe
-
Size
765KB
-
MD5
910ed35fc185c91ecb41070ab775831f
-
SHA1
0e5301a4067825a696060464901e561695121af2
-
SHA256
4178649565495cf2136b273c65c97c28c9dafddebf7deeb499bd9be340145872
-
SHA512
9d4c78248150fe8edd2dc7948e791a4c0e227f830d2b046ee2bdae09429acd67d600d00d700c8271ad0b344a2fa65bade6d6c866aa5af5912ec02107334cce26
-
SSDEEP
12288:ZU5rCOTeiDKV1TFDX4tV5V3ZF5rn5rLOa54U5w5A:ZUQOJDAstV/3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2036 2452.tmp 2908 251D.tmp 1376 25D8.tmp 2580 2674.tmp 2540 26F1.tmp 2656 275E.tmp 2672 280A.tmp 2520 28C5.tmp 2556 2971.tmp 2428 29CE.tmp 2984 2A2C.tmp 2016 2B16.tmp 2740 2B93.tmp 2736 2BE1.tmp 2888 2CDA.tmp 2648 2D28.tmp 988 2DF3.tmp 1188 2E51.tmp 2436 2E9F.tmp 2680 2EED.tmp 1016 2F2B.tmp 2892 2F79.tmp 1520 2FB8.tmp 2348 2FF6.tmp 3048 3034.tmp 2252 3073.tmp 2256 30E0.tmp 2244 313E.tmp 628 317C.tmp 868 31CA.tmp 780 3208.tmp 728 3247.tmp 1412 3285.tmp 1752 32C4.tmp 1308 3302.tmp 1708 3340.tmp 2096 339E.tmp 500 33EC.tmp 3012 344A.tmp 2824 34D6.tmp 1264 3543.tmp 1888 3582.tmp 2836 35FE.tmp 1868 365C.tmp 900 36AA.tmp 2028 3717.tmp 2056 3775.tmp 2796 37F2.tmp 2296 3840.tmp 352 388E.tmp 1184 38DC.tmp 2864 391A.tmp 884 3958.tmp 2124 39A6.tmp 1732 39F4.tmp 1512 3A33.tmp 1668 3A81.tmp 2020 3ACF.tmp 1168 3B1D.tmp 2908 3B5B.tmp 2524 3BA9.tmp 2816 3BE8.tmp 2608 3C26.tmp 2540 3C84.tmp -
Loads dropped DLL 64 IoCs
pid Process 112 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 2036 2452.tmp 2908 251D.tmp 1376 25D8.tmp 2580 2674.tmp 2540 26F1.tmp 2656 275E.tmp 2672 280A.tmp 2520 28C5.tmp 2556 2971.tmp 2428 29CE.tmp 2984 2A2C.tmp 2016 2B16.tmp 2740 2B93.tmp 2736 2BE1.tmp 2888 2CDA.tmp 2648 2D28.tmp 988 2DF3.tmp 1188 2E51.tmp 2436 2E9F.tmp 2680 2EED.tmp 1016 2F2B.tmp 2892 2F79.tmp 1520 2FB8.tmp 2348 2FF6.tmp 3048 3034.tmp 2252 3073.tmp 2256 30E0.tmp 2244 313E.tmp 628 317C.tmp 868 31CA.tmp 780 3208.tmp 728 3247.tmp 1412 3285.tmp 1752 32C4.tmp 1308 3302.tmp 1708 3340.tmp 2096 339E.tmp 500 33EC.tmp 3012 344A.tmp 2824 34D6.tmp 1264 3543.tmp 1888 3582.tmp 2836 35FE.tmp 1868 365C.tmp 900 36AA.tmp 2028 3717.tmp 2056 3775.tmp 2796 37F2.tmp 2296 3840.tmp 352 388E.tmp 1184 38DC.tmp 2864 391A.tmp 884 3958.tmp 2124 39A6.tmp 1732 39F4.tmp 1512 3A33.tmp 1668 3A81.tmp 2020 3ACF.tmp 1168 3B1D.tmp 2908 3B5B.tmp 2524 3BA9.tmp 2816 3BE8.tmp 2608 3C26.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 112 wrote to memory of 2036 112 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 28 PID 112 wrote to memory of 2036 112 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 28 PID 112 wrote to memory of 2036 112 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 28 PID 112 wrote to memory of 2036 112 2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe 28 PID 2036 wrote to memory of 2908 2036 2452.tmp 29 PID 2036 wrote to memory of 2908 2036 2452.tmp 29 PID 2036 wrote to memory of 2908 2036 2452.tmp 29 PID 2036 wrote to memory of 2908 2036 2452.tmp 29 PID 2908 wrote to memory of 1376 2908 251D.tmp 30 PID 2908 wrote to memory of 1376 2908 251D.tmp 30 PID 2908 wrote to memory of 1376 2908 251D.tmp 30 PID 2908 wrote to memory of 1376 2908 251D.tmp 30 PID 1376 wrote to memory of 2580 1376 25D8.tmp 31 PID 1376 wrote to memory of 2580 1376 25D8.tmp 31 PID 1376 wrote to memory of 2580 1376 25D8.tmp 31 PID 1376 wrote to memory of 2580 1376 25D8.tmp 31 PID 2580 wrote to memory of 2540 2580 2674.tmp 32 PID 2580 wrote to memory of 2540 2580 2674.tmp 32 PID 2580 wrote to memory of 2540 2580 2674.tmp 32 PID 2580 wrote to memory of 2540 2580 2674.tmp 32 PID 2540 wrote to memory of 2656 2540 26F1.tmp 33 PID 2540 wrote to memory of 2656 2540 26F1.tmp 33 PID 2540 wrote to memory of 2656 2540 26F1.tmp 33 PID 2540 wrote to memory of 2656 2540 26F1.tmp 33 PID 2656 wrote to memory of 2672 2656 275E.tmp 34 PID 2656 wrote to memory of 2672 2656 275E.tmp 34 PID 2656 wrote to memory of 2672 2656 275E.tmp 34 PID 2656 wrote to memory of 2672 2656 275E.tmp 34 PID 2672 wrote to memory of 2520 2672 280A.tmp 35 PID 2672 wrote to memory of 2520 2672 280A.tmp 35 PID 2672 wrote to memory of 2520 2672 280A.tmp 35 PID 2672 wrote to memory of 2520 2672 280A.tmp 35 PID 2520 wrote to memory of 2556 2520 28C5.tmp 36 PID 2520 wrote to memory of 2556 2520 28C5.tmp 36 PID 2520 wrote to memory of 2556 2520 28C5.tmp 36 PID 2520 wrote to memory of 2556 2520 28C5.tmp 36 PID 2556 wrote to memory of 2428 2556 2971.tmp 37 PID 2556 wrote to memory of 2428 2556 2971.tmp 37 PID 2556 wrote to memory of 2428 2556 2971.tmp 37 PID 2556 wrote to memory of 2428 2556 2971.tmp 37 PID 2428 wrote to memory of 2984 2428 29CE.tmp 38 PID 2428 wrote to memory of 2984 2428 29CE.tmp 38 PID 2428 wrote to memory of 2984 2428 29CE.tmp 38 PID 2428 wrote to memory of 2984 2428 29CE.tmp 38 PID 2984 wrote to memory of 2016 2984 2A2C.tmp 39 PID 2984 wrote to memory of 2016 2984 2A2C.tmp 39 PID 2984 wrote to memory of 2016 2984 2A2C.tmp 39 PID 2984 wrote to memory of 2016 2984 2A2C.tmp 39 PID 2016 wrote to memory of 2740 2016 2B16.tmp 40 PID 2016 wrote to memory of 2740 2016 2B16.tmp 40 PID 2016 wrote to memory of 2740 2016 2B16.tmp 40 PID 2016 wrote to memory of 2740 2016 2B16.tmp 40 PID 2740 wrote to memory of 2736 2740 2B93.tmp 41 PID 2740 wrote to memory of 2736 2740 2B93.tmp 41 PID 2740 wrote to memory of 2736 2740 2B93.tmp 41 PID 2740 wrote to memory of 2736 2740 2B93.tmp 41 PID 2736 wrote to memory of 2888 2736 2BE1.tmp 42 PID 2736 wrote to memory of 2888 2736 2BE1.tmp 42 PID 2736 wrote to memory of 2888 2736 2BE1.tmp 42 PID 2736 wrote to memory of 2888 2736 2BE1.tmp 42 PID 2888 wrote to memory of 2648 2888 2CDA.tmp 43 PID 2888 wrote to memory of 2648 2888 2CDA.tmp 43 PID 2888 wrote to memory of 2648 2888 2CDA.tmp 43 PID 2888 wrote to memory of 2648 2888 2CDA.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_910ed35fc185c91ecb41070ab775831f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:728 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:500 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"65⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"66⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"67⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"68⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"69⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"70⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"71⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"72⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"73⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"74⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"75⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"76⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"77⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"78⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"79⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"80⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"81⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"82⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"83⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"84⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"85⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"86⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"87⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"88⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"89⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"90⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"92⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"93⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"94⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"95⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"96⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"97⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"98⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"99⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"100⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"101⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"102⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"103⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"104⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"105⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"106⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"107⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"108⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"109⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\49DC.tmp"C:\Users\Admin\AppData\Local\Temp\49DC.tmp"111⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"112⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\4A68.tmp"C:\Users\Admin\AppData\Local\Temp\4A68.tmp"113⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"114⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"115⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"116⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"117⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"118⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"119⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"120⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"121⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"122⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-