Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe
-
Size
486KB
-
MD5
9cdc4afb83cf47d44f18c65ff6168579
-
SHA1
d07cef4c453ea6e52ce70125c52f51f6fbe38036
-
SHA256
4f47868976913ceeb3bbbe0c13bd2557838934c1e962334ff51f49c9e6675ac2
-
SHA512
fe2f979f3917735992f9aef0985095a5fa51f3c413994807988ee27e78a7de41ca427ab25240ef353560ae5fa4cc799a81d6aaee7841e7cf40bf2f5324141dcf
-
SSDEEP
12288:/U5rCOTeiDKlK+BxHGyaxJi79Uv7BsNWNZ:/UQOJDK4+BRgJi7Svts0N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2204 2185.tmp 2208 21D3.tmp 2988 2211.tmp 3068 226F.tmp 2648 22BD.tmp 2552 231A.tmp 2540 2378.tmp 2768 2443.tmp 2588 2491.tmp 2428 24FE.tmp 660 256B.tmp 1152 2655.tmp 1092 26E2.tmp 2512 276E.tmp 2924 27FA.tmp 1376 2877.tmp 1288 28B6.tmp 1776 2923.tmp 1704 29AF.tmp 1324 2A2C.tmp 2660 2AB8.tmp 288 2B54.tmp 1300 2BC2.tmp 1232 2C00.tmp 1760 2C3E.tmp 2100 2C7D.tmp 1628 2CCB.tmp 544 2D19.tmp 1952 2D67.tmp 2868 2DA5.tmp 2408 2DF3.tmp 1264 2E41.tmp 1480 2E8F.tmp 3040 2ECE.tmp 2968 2F0C.tmp 1724 2F4A.tmp 344 2F89.tmp 1068 2FD7.tmp 1968 3025.tmp 1444 3073.tmp 1540 30C1.tmp 956 30FF.tmp 2116 313E.tmp 568 317C.tmp 900 31BA.tmp 756 3208.tmp 2396 3247.tmp 2336 3295.tmp 2776 32D3.tmp 988 3312.tmp 2052 3360.tmp 884 33AE.tmp 1668 33FC.tmp 2348 3459.tmp 1584 34A7.tmp 1796 34F5.tmp 2172 3543.tmp 2568 3591.tmp 2280 35DF.tmp 2516 362D.tmp 2636 367B.tmp 2580 36C9.tmp 2576 3717.tmp 3060 3765.tmp -
Loads dropped DLL 64 IoCs
pid Process 3016 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 2204 2185.tmp 2208 21D3.tmp 2988 2211.tmp 3068 226F.tmp 2648 22BD.tmp 2552 231A.tmp 2540 2378.tmp 2768 2443.tmp 2588 2491.tmp 2428 24FE.tmp 660 256B.tmp 1152 2655.tmp 1092 26E2.tmp 2512 276E.tmp 2924 27FA.tmp 1376 2877.tmp 1288 28B6.tmp 1776 2923.tmp 1704 29AF.tmp 1324 2A2C.tmp 2660 2AB8.tmp 288 2B54.tmp 1300 2BC2.tmp 1232 2C00.tmp 1760 2C3E.tmp 2100 2C7D.tmp 1628 2CCB.tmp 544 2D19.tmp 1952 2D67.tmp 2868 2DA5.tmp 2408 2DF3.tmp 1264 2E41.tmp 1480 2E8F.tmp 3040 2ECE.tmp 2968 2F0C.tmp 1724 2F4A.tmp 344 2F89.tmp 1068 2FD7.tmp 1968 3025.tmp 1444 3073.tmp 1540 30C1.tmp 956 30FF.tmp 2116 313E.tmp 568 317C.tmp 900 31BA.tmp 756 3208.tmp 2396 3247.tmp 2336 3295.tmp 2776 32D3.tmp 988 3312.tmp 2052 3360.tmp 884 33AE.tmp 1668 33FC.tmp 2348 3459.tmp 1584 34A7.tmp 1796 34F5.tmp 2172 3543.tmp 2568 3591.tmp 2280 35DF.tmp 2516 362D.tmp 2636 367B.tmp 2580 36C9.tmp 2576 3717.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2204 3016 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 28 PID 3016 wrote to memory of 2204 3016 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 28 PID 3016 wrote to memory of 2204 3016 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 28 PID 3016 wrote to memory of 2204 3016 2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe 28 PID 2204 wrote to memory of 2208 2204 2185.tmp 29 PID 2204 wrote to memory of 2208 2204 2185.tmp 29 PID 2204 wrote to memory of 2208 2204 2185.tmp 29 PID 2204 wrote to memory of 2208 2204 2185.tmp 29 PID 2208 wrote to memory of 2988 2208 21D3.tmp 30 PID 2208 wrote to memory of 2988 2208 21D3.tmp 30 PID 2208 wrote to memory of 2988 2208 21D3.tmp 30 PID 2208 wrote to memory of 2988 2208 21D3.tmp 30 PID 2988 wrote to memory of 3068 2988 2211.tmp 31 PID 2988 wrote to memory of 3068 2988 2211.tmp 31 PID 2988 wrote to memory of 3068 2988 2211.tmp 31 PID 2988 wrote to memory of 3068 2988 2211.tmp 31 PID 3068 wrote to memory of 2648 3068 226F.tmp 32 PID 3068 wrote to memory of 2648 3068 226F.tmp 32 PID 3068 wrote to memory of 2648 3068 226F.tmp 32 PID 3068 wrote to memory of 2648 3068 226F.tmp 32 PID 2648 wrote to memory of 2552 2648 22BD.tmp 33 PID 2648 wrote to memory of 2552 2648 22BD.tmp 33 PID 2648 wrote to memory of 2552 2648 22BD.tmp 33 PID 2648 wrote to memory of 2552 2648 22BD.tmp 33 PID 2552 wrote to memory of 2540 2552 231A.tmp 34 PID 2552 wrote to memory of 2540 2552 231A.tmp 34 PID 2552 wrote to memory of 2540 2552 231A.tmp 34 PID 2552 wrote to memory of 2540 2552 231A.tmp 34 PID 2540 wrote to memory of 2768 2540 2378.tmp 35 PID 2540 wrote to memory of 2768 2540 2378.tmp 35 PID 2540 wrote to memory of 2768 2540 2378.tmp 35 PID 2540 wrote to memory of 2768 2540 2378.tmp 35 PID 2768 wrote to memory of 2588 2768 2443.tmp 36 PID 2768 wrote to memory of 2588 2768 2443.tmp 36 PID 2768 wrote to memory of 2588 2768 2443.tmp 36 PID 2768 wrote to memory of 2588 2768 2443.tmp 36 PID 2588 wrote to memory of 2428 2588 2491.tmp 37 PID 2588 wrote to memory of 2428 2588 2491.tmp 37 PID 2588 wrote to memory of 2428 2588 2491.tmp 37 PID 2588 wrote to memory of 2428 2588 2491.tmp 37 PID 2428 wrote to memory of 660 2428 24FE.tmp 38 PID 2428 wrote to memory of 660 2428 24FE.tmp 38 PID 2428 wrote to memory of 660 2428 24FE.tmp 38 PID 2428 wrote to memory of 660 2428 24FE.tmp 38 PID 660 wrote to memory of 1152 660 256B.tmp 39 PID 660 wrote to memory of 1152 660 256B.tmp 39 PID 660 wrote to memory of 1152 660 256B.tmp 39 PID 660 wrote to memory of 1152 660 256B.tmp 39 PID 1152 wrote to memory of 1092 1152 2655.tmp 40 PID 1152 wrote to memory of 1092 1152 2655.tmp 40 PID 1152 wrote to memory of 1092 1152 2655.tmp 40 PID 1152 wrote to memory of 1092 1152 2655.tmp 40 PID 1092 wrote to memory of 2512 1092 26E2.tmp 41 PID 1092 wrote to memory of 2512 1092 26E2.tmp 41 PID 1092 wrote to memory of 2512 1092 26E2.tmp 41 PID 1092 wrote to memory of 2512 1092 26E2.tmp 41 PID 2512 wrote to memory of 2924 2512 276E.tmp 42 PID 2512 wrote to memory of 2924 2512 276E.tmp 42 PID 2512 wrote to memory of 2924 2512 276E.tmp 42 PID 2512 wrote to memory of 2924 2512 276E.tmp 42 PID 2924 wrote to memory of 1376 2924 27FA.tmp 43 PID 2924 wrote to memory of 1376 2924 27FA.tmp 43 PID 2924 wrote to memory of 1376 2924 27FA.tmp 43 PID 2924 wrote to memory of 1376 2924 27FA.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-16_9cdc4afb83cf47d44f18c65ff6168579_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"65⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"66⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"67⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\3840.tmp"C:\Users\Admin\AppData\Local\Temp\3840.tmp"68⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"69⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"70⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"71⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"72⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"73⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"74⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"75⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"76⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"77⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"78⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"79⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"80⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"81⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"82⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"83⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"84⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"85⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"86⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"87⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"89⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"90⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"91⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"92⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"93⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"94⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"95⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"96⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"97⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"98⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"99⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"100⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"101⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"102⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"103⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"104⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"105⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"106⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"107⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"108⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"109⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"110⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"111⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"113⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"114⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"115⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"116⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"117⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"118⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"119⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"120⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"121⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"122⤵PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-