Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe
-
Size
530KB
-
MD5
843f398ed4300bae96c22067fafa0084
-
SHA1
818a42d3bea1a90bd034136312052853de294456
-
SHA256
ad5161fc31e47fb4c5f78e58d1881e32381ca9005301138ce24444a42ca62d1d
-
SHA512
00d4900028415593627331c0917d7868acf3ae860daa4482afcaff5e0962bd1eb10cac4dcd70cd0a0353d90d81dac65237631e80705d133c391e535785d95e95
-
SSDEEP
12288:AU5rCOTeioAn3nu9F77tx267V0piNgPwAagyNZulFVg0M1:AUQOJo8Xu9tpx26lOPvfyNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2764 1FD0.tmp 2976 201E.tmp 2556 209B.tmp 2676 20F8.tmp 2988 2166.tmp 2568 21C3.tmp 2696 2230.tmp 2200 229E.tmp 2428 22FB.tmp 2872 2359.tmp 2888 23B6.tmp 2700 2414.tmp 2732 2472.tmp 2836 24EE.tmp 1172 252D.tmp 284 258A.tmp 1552 25F8.tmp 2292 2674.tmp 1432 26E2.tmp 2656 273F.tmp 2216 27AC.tmp 1280 280A.tmp 2028 2868.tmp 2096 28B6.tmp 2128 28F4.tmp 496 2942.tmp 2280 2990.tmp 2100 29CE.tmp 1976 2A1C.tmp 2256 2A6A.tmp 592 2AA9.tmp 948 2AF7.tmp 2804 2B45.tmp 2916 2B93.tmp 352 2BD1.tmp 2172 2C10.tmp 412 2C5E.tmp 3012 2CAC.tmp 2372 2CFA.tmp 1488 2D38.tmp 1684 2D86.tmp 1556 2DD4.tmp 1236 2E22.tmp 2300 2E60.tmp 108 2E9F.tmp 1448 2EDD.tmp 2968 2F2B.tmp 1628 2F79.tmp 2352 2FB8.tmp 2112 3006.tmp 2788 3054.tmp 2940 30A2.tmp 912 30E0.tmp 2948 311E.tmp 1732 316C.tmp 1536 31AB.tmp 2980 31F9.tmp 1980 3237.tmp 1936 3285.tmp 2516 32E3.tmp 2664 3321.tmp 2780 338E.tmp 2540 33CD.tmp 2680 340B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1968 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 2764 1FD0.tmp 2976 201E.tmp 2556 209B.tmp 2676 20F8.tmp 2988 2166.tmp 2568 21C3.tmp 2696 2230.tmp 2200 229E.tmp 2428 22FB.tmp 2872 2359.tmp 2888 23B6.tmp 2700 2414.tmp 2732 2472.tmp 2836 24EE.tmp 1172 252D.tmp 284 258A.tmp 1552 25F8.tmp 2292 2674.tmp 1432 26E2.tmp 2656 273F.tmp 2216 27AC.tmp 1280 280A.tmp 2028 2868.tmp 2096 28B6.tmp 2128 28F4.tmp 496 2942.tmp 2280 2990.tmp 2100 29CE.tmp 1976 2A1C.tmp 2256 2A6A.tmp 592 2AA9.tmp 948 2AF7.tmp 2804 2B45.tmp 2916 2B93.tmp 352 2BD1.tmp 2172 2C10.tmp 412 2C5E.tmp 3012 2CAC.tmp 2372 2CFA.tmp 1488 2D38.tmp 1684 2D86.tmp 1556 2DD4.tmp 1236 2E22.tmp 2300 2E60.tmp 108 2E9F.tmp 1448 2EDD.tmp 2968 2F2B.tmp 1628 2F79.tmp 2352 2FB8.tmp 2112 3006.tmp 2788 3054.tmp 2940 30A2.tmp 912 30E0.tmp 2948 311E.tmp 1732 316C.tmp 1536 31AB.tmp 2980 31F9.tmp 1980 3237.tmp 1936 3285.tmp 2516 32E3.tmp 2664 3321.tmp 2780 338E.tmp 2540 33CD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2764 1968 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 28 PID 1968 wrote to memory of 2764 1968 2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe 28 PID 2764 wrote to memory of 2976 2764 1FD0.tmp 29 PID 2764 wrote to memory of 2976 2764 1FD0.tmp 29 PID 2764 wrote to memory of 2976 2764 1FD0.tmp 29 PID 2764 wrote to memory of 2976 2764 1FD0.tmp 29 PID 2976 wrote to memory of 2556 2976 201E.tmp 30 PID 2976 wrote to memory of 2556 2976 201E.tmp 30 PID 2976 wrote to memory of 2556 2976 201E.tmp 30 PID 2976 wrote to memory of 2556 2976 201E.tmp 30 PID 2556 wrote to memory of 2676 2556 209B.tmp 31 PID 2556 wrote to memory of 2676 2556 209B.tmp 31 PID 2556 wrote to memory of 2676 2556 209B.tmp 31 PID 2556 wrote to memory of 2676 2556 209B.tmp 31 PID 2676 wrote to memory of 2988 2676 20F8.tmp 32 PID 2676 wrote to memory of 2988 2676 20F8.tmp 32 PID 2676 wrote to memory of 2988 2676 20F8.tmp 32 PID 2676 wrote to memory of 2988 2676 20F8.tmp 32 PID 2988 wrote to memory of 2568 2988 2166.tmp 33 PID 2988 wrote to memory of 2568 2988 2166.tmp 33 PID 2988 wrote to memory of 2568 2988 2166.tmp 33 PID 2988 wrote to memory of 2568 2988 2166.tmp 33 PID 2568 wrote to memory of 2696 2568 21C3.tmp 34 PID 2568 wrote to memory of 2696 2568 21C3.tmp 34 PID 2568 wrote to memory of 2696 2568 21C3.tmp 34 PID 2568 wrote to memory of 2696 2568 21C3.tmp 34 PID 2696 wrote to memory of 2200 2696 2230.tmp 35 PID 2696 wrote to memory of 2200 2696 2230.tmp 35 PID 2696 wrote to memory of 2200 2696 2230.tmp 35 PID 2696 wrote to memory of 2200 2696 2230.tmp 35 PID 2200 wrote to memory of 2428 2200 229E.tmp 36 PID 2200 wrote to memory of 2428 2200 229E.tmp 36 PID 2200 wrote to memory of 2428 2200 229E.tmp 36 PID 2200 wrote to memory of 2428 2200 229E.tmp 36 PID 2428 wrote to memory of 2872 2428 22FB.tmp 37 PID 2428 wrote to memory of 2872 2428 22FB.tmp 37 PID 2428 wrote to memory of 2872 2428 22FB.tmp 37 PID 2428 wrote to memory of 2872 2428 22FB.tmp 37 PID 2872 wrote to memory of 2888 2872 2359.tmp 38 PID 2872 wrote to memory of 2888 2872 2359.tmp 38 PID 2872 wrote to memory of 2888 2872 2359.tmp 38 PID 2872 wrote to memory of 2888 2872 2359.tmp 38 PID 2888 wrote to memory of 2700 2888 23B6.tmp 39 PID 2888 wrote to memory of 2700 2888 23B6.tmp 39 PID 2888 wrote to memory of 2700 2888 23B6.tmp 39 PID 2888 wrote to memory of 2700 2888 23B6.tmp 39 PID 2700 wrote to memory of 2732 2700 2414.tmp 40 PID 2700 wrote to memory of 2732 2700 2414.tmp 40 PID 2700 wrote to memory of 2732 2700 2414.tmp 40 PID 2700 wrote to memory of 2732 2700 2414.tmp 40 PID 2732 wrote to memory of 2836 2732 2472.tmp 41 PID 2732 wrote to memory of 2836 2732 2472.tmp 41 PID 2732 wrote to memory of 2836 2732 2472.tmp 41 PID 2732 wrote to memory of 2836 2732 2472.tmp 41 PID 2836 wrote to memory of 1172 2836 24EE.tmp 42 PID 2836 wrote to memory of 1172 2836 24EE.tmp 42 PID 2836 wrote to memory of 1172 2836 24EE.tmp 42 PID 2836 wrote to memory of 1172 2836 24EE.tmp 42 PID 1172 wrote to memory of 284 1172 252D.tmp 43 PID 1172 wrote to memory of 284 1172 252D.tmp 43 PID 1172 wrote to memory of 284 1172 252D.tmp 43 PID 1172 wrote to memory of 284 1172 252D.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_843f398ed4300bae96c22067fafa0084_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:412 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"66⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"67⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"68⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"69⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"70⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"71⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\35EF.tmp"C:\Users\Admin\AppData\Local\Temp\35EF.tmp"72⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"73⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"74⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"75⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\3708.tmp"C:\Users\Admin\AppData\Local\Temp\3708.tmp"76⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"77⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"78⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"79⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"80⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"81⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"82⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"83⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"84⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"85⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"87⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"88⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"89⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"90⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"91⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"92⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"93⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"94⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"95⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"96⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"97⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"98⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"99⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"100⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"102⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"103⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"104⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"105⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"106⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"107⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"108⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"109⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"110⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"111⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"112⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"113⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"114⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"115⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"116⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"117⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"118⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"119⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"120⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"122⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-