Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 19:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe
-
Size
529KB
-
MD5
42f7c202b0c0764a2cbf826dfb673c9a
-
SHA1
7406957e1e932bc7b84f604788585a125bf3e045
-
SHA256
ae6d4cb94059bef595e8eb463f73e846186da312954849f8d3b1d6dc7ffaaa2e
-
SHA512
23bc087c468879dbabb337a4f294695feff6cd6c3e2818cc7eb007c8731c91d490a29026822610b36c9b556f99d5b3ee619ff0c139f46f8d203c0284894d6cdd
-
SSDEEP
12288:NU5rCOTeijgvNaPKGNIzzftoOBCa/JwuKbTZwlH4Hp:NUQOJjgVaIftoir/JhKbTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2056 31F9.tmp 2128 3256.tmp 2604 32C4.tmp 2732 3331.tmp 2728 339E.tmp 2644 340B.tmp 1900 3488.tmp 2536 34F5.tmp 2680 3562.tmp 2524 35D0.tmp 2588 363D.tmp 2196 36BA.tmp 1044 3727.tmp 316 3794.tmp 2688 3811.tmp 2760 388E.tmp 308 38FB.tmp 1084 3978.tmp 2224 39E5.tmp 2408 3A52.tmp 344 3ABF.tmp 772 3B1D.tmp 1080 3B8A.tmp 632 3BC8.tmp 2864 3C16.tmp 800 3C55.tmp 292 3C93.tmp 2316 3CD2.tmp 2872 3D10.tmp 1632 3D4E.tmp 1532 3D8D.tmp 3040 3DCB.tmp 2256 3E0A.tmp 1476 3E48.tmp 1208 3E86.tmp 1828 3EC5.tmp 1744 3F03.tmp 2376 3F42.tmp 2344 3F80.tmp 1140 3FCE.tmp 832 400C.tmp 1540 404B.tmp 944 4099.tmp 980 40D7.tmp 1416 4116.tmp 2476 4154.tmp 1072 4192.tmp 1944 41D1.tmp 3000 420F.tmp 1484 424E.tmp 2908 428C.tmp 1564 42CA.tmp 1668 4309.tmp 2096 4347.tmp 1056 4386.tmp 1592 43C4.tmp 1508 4402.tmp 1872 4441.tmp 1608 447F.tmp 2840 44BE.tmp 2640 44FC.tmp 2816 453A.tmp 2820 4579.tmp 2636 45B7.tmp -
Loads dropped DLL 64 IoCs
pid Process 1240 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 2056 31F9.tmp 2128 3256.tmp 2604 32C4.tmp 2732 3331.tmp 2728 339E.tmp 2644 340B.tmp 1900 3488.tmp 2536 34F5.tmp 2680 3562.tmp 2524 35D0.tmp 2588 363D.tmp 2196 36BA.tmp 1044 3727.tmp 316 3794.tmp 2688 3811.tmp 2760 388E.tmp 308 38FB.tmp 1084 3978.tmp 2224 39E5.tmp 2408 3A52.tmp 344 3ABF.tmp 772 3B1D.tmp 1080 3B8A.tmp 632 3BC8.tmp 2864 3C16.tmp 800 3C55.tmp 292 3C93.tmp 2316 3CD2.tmp 2872 3D10.tmp 1632 3D4E.tmp 1532 3D8D.tmp 3040 3DCB.tmp 2256 3E0A.tmp 1476 3E48.tmp 1208 3E86.tmp 1828 3EC5.tmp 1744 3F03.tmp 2376 3F42.tmp 2344 3F80.tmp 1140 3FCE.tmp 832 400C.tmp 1540 404B.tmp 944 4099.tmp 980 40D7.tmp 1416 4116.tmp 2476 4154.tmp 1072 4192.tmp 1944 41D1.tmp 3000 420F.tmp 1484 424E.tmp 2908 428C.tmp 1564 42CA.tmp 1668 4309.tmp 2096 4347.tmp 1056 4386.tmp 1592 43C4.tmp 1508 4402.tmp 1872 4441.tmp 1608 447F.tmp 2840 44BE.tmp 2640 44FC.tmp 2816 453A.tmp 2820 4579.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2056 1240 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 28 PID 1240 wrote to memory of 2056 1240 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 28 PID 1240 wrote to memory of 2056 1240 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 28 PID 1240 wrote to memory of 2056 1240 2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe 28 PID 2056 wrote to memory of 2128 2056 31F9.tmp 29 PID 2056 wrote to memory of 2128 2056 31F9.tmp 29 PID 2056 wrote to memory of 2128 2056 31F9.tmp 29 PID 2056 wrote to memory of 2128 2056 31F9.tmp 29 PID 2128 wrote to memory of 2604 2128 3256.tmp 30 PID 2128 wrote to memory of 2604 2128 3256.tmp 30 PID 2128 wrote to memory of 2604 2128 3256.tmp 30 PID 2128 wrote to memory of 2604 2128 3256.tmp 30 PID 2604 wrote to memory of 2732 2604 32C4.tmp 31 PID 2604 wrote to memory of 2732 2604 32C4.tmp 31 PID 2604 wrote to memory of 2732 2604 32C4.tmp 31 PID 2604 wrote to memory of 2732 2604 32C4.tmp 31 PID 2732 wrote to memory of 2728 2732 3331.tmp 32 PID 2732 wrote to memory of 2728 2732 3331.tmp 32 PID 2732 wrote to memory of 2728 2732 3331.tmp 32 PID 2732 wrote to memory of 2728 2732 3331.tmp 32 PID 2728 wrote to memory of 2644 2728 339E.tmp 33 PID 2728 wrote to memory of 2644 2728 339E.tmp 33 PID 2728 wrote to memory of 2644 2728 339E.tmp 33 PID 2728 wrote to memory of 2644 2728 339E.tmp 33 PID 2644 wrote to memory of 1900 2644 340B.tmp 34 PID 2644 wrote to memory of 1900 2644 340B.tmp 34 PID 2644 wrote to memory of 1900 2644 340B.tmp 34 PID 2644 wrote to memory of 1900 2644 340B.tmp 34 PID 1900 wrote to memory of 2536 1900 3488.tmp 35 PID 1900 wrote to memory of 2536 1900 3488.tmp 35 PID 1900 wrote to memory of 2536 1900 3488.tmp 35 PID 1900 wrote to memory of 2536 1900 3488.tmp 35 PID 2536 wrote to memory of 2680 2536 34F5.tmp 36 PID 2536 wrote to memory of 2680 2536 34F5.tmp 36 PID 2536 wrote to memory of 2680 2536 34F5.tmp 36 PID 2536 wrote to memory of 2680 2536 34F5.tmp 36 PID 2680 wrote to memory of 2524 2680 3562.tmp 37 PID 2680 wrote to memory of 2524 2680 3562.tmp 37 PID 2680 wrote to memory of 2524 2680 3562.tmp 37 PID 2680 wrote to memory of 2524 2680 3562.tmp 37 PID 2524 wrote to memory of 2588 2524 35D0.tmp 38 PID 2524 wrote to memory of 2588 2524 35D0.tmp 38 PID 2524 wrote to memory of 2588 2524 35D0.tmp 38 PID 2524 wrote to memory of 2588 2524 35D0.tmp 38 PID 2588 wrote to memory of 2196 2588 363D.tmp 39 PID 2588 wrote to memory of 2196 2588 363D.tmp 39 PID 2588 wrote to memory of 2196 2588 363D.tmp 39 PID 2588 wrote to memory of 2196 2588 363D.tmp 39 PID 2196 wrote to memory of 1044 2196 36BA.tmp 40 PID 2196 wrote to memory of 1044 2196 36BA.tmp 40 PID 2196 wrote to memory of 1044 2196 36BA.tmp 40 PID 2196 wrote to memory of 1044 2196 36BA.tmp 40 PID 1044 wrote to memory of 316 1044 3727.tmp 41 PID 1044 wrote to memory of 316 1044 3727.tmp 41 PID 1044 wrote to memory of 316 1044 3727.tmp 41 PID 1044 wrote to memory of 316 1044 3727.tmp 41 PID 316 wrote to memory of 2688 316 3794.tmp 42 PID 316 wrote to memory of 2688 316 3794.tmp 42 PID 316 wrote to memory of 2688 316 3794.tmp 42 PID 316 wrote to memory of 2688 316 3794.tmp 42 PID 2688 wrote to memory of 2760 2688 3811.tmp 43 PID 2688 wrote to memory of 2760 2688 3811.tmp 43 PID 2688 wrote to memory of 2760 2688 3811.tmp 43 PID 2688 wrote to memory of 2760 2688 3811.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_42f7c202b0c0764a2cbf826dfb673c9a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632 -
C:\Users\Admin\AppData\Local\Temp\3C16.tmp"C:\Users\Admin\AppData\Local\Temp\3C16.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3C55.tmp"C:\Users\Admin\AppData\Local\Temp\3C55.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\3F42.tmp"C:\Users\Admin\AppData\Local\Temp\3F42.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\40D7.tmp"C:\Users\Admin\AppData\Local\Temp\40D7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\428C.tmp"C:\Users\Admin\AppData\Local\Temp\428C.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4402.tmp"C:\Users\Admin\AppData\Local\Temp\4402.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4441.tmp"C:\Users\Admin\AppData\Local\Temp\4441.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"66⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"67⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"68⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"69⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"70⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"71⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"72⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"73⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"74⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"75⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"76⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"77⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"78⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"79⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\495F.tmp"C:\Users\Admin\AppData\Local\Temp\495F.tmp"80⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"81⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\49EC.tmp"C:\Users\Admin\AppData\Local\Temp\49EC.tmp"82⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"83⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"84⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"85⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"86⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"87⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"88⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"89⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"90⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"91⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"92⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"93⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"94⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"95⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"96⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"97⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"99⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"100⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"101⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"102⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"103⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"104⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"105⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"106⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5013.tmp"C:\Users\Admin\AppData\Local\Temp\5013.tmp"107⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"108⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"109⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\50CE.tmp"C:\Users\Admin\AppData\Local\Temp\50CE.tmp"110⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"111⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"112⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"113⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\51C8.tmp"C:\Users\Admin\AppData\Local\Temp\51C8.tmp"114⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"115⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"116⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"117⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"118⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\533E.tmp"C:\Users\Admin\AppData\Local\Temp\533E.tmp"120⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"121⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-