Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 08:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe
-
Size
486KB
-
MD5
b68a99d80b36af50307a1ef23c3365b3
-
SHA1
bf552466d31dea7f082236b0a624918b5565c731
-
SHA256
73fc74cd44c2187cd0abdd94be184081d0009747ea51ace8d0263fd2de47612b
-
SHA512
965d00785be5ff90f6408869b071cd781a31ea8ffbe65b094d1153b8a68beb66fb5dc3dd5691f82bfbb92300655c414b0026f15249a01e570ca5247dd47c6609
-
SSDEEP
12288:UU5rCOTeiDjRtakjQ7OZvU3LqCM2pJcZNZ:UUQOJDjRQRylOuCDpqN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3040 26E2.tmp 2600 275E.tmp 2352 27DB.tmp 2624 2848.tmp 2808 28B6.tmp 2840 2932.tmp 2648 29A0.tmp 2608 2A1C.tmp 2788 2A8A.tmp 2524 2B06.tmp 2592 2B64.tmp 2164 2BE1.tmp 1884 2C3E.tmp 1052 2CAC.tmp 2748 2D09.tmp 1824 2D57.tmp 2736 2DC4.tmp 1832 2E41.tmp 1876 2EAE.tmp 676 2F0C.tmp 2760 2F6A.tmp 536 2FD7.tmp 788 3044.tmp 1092 3092.tmp 1352 30D0.tmp 1528 310F.tmp 1520 314D.tmp 2368 319B.tmp 2340 31DA.tmp 2732 3218.tmp 1084 3256.tmp 2148 32A4.tmp 2188 32E3.tmp 1632 3321.tmp 572 3360.tmp 540 33AE.tmp 2744 33EC.tmp 1792 343A.tmp 1148 3478.tmp 2488 34B7.tmp 2008 34F5.tmp 1388 3543.tmp 2012 3582.tmp 1364 35C0.tmp 1608 360E.tmp 2268 364C.tmp 972 368B.tmp 576 36D9.tmp 1932 3717.tmp 1980 3765.tmp 1188 37A4.tmp 396 37F2.tmp 1768 3830.tmp 2436 387E.tmp 1724 38BC.tmp 1600 38FB.tmp 3008 3939.tmp 2604 3978.tmp 2884 39B6.tmp 3020 3A04.tmp 2400 3A52.tmp 2668 3AA0.tmp 2624 3ADE.tmp 2676 3B1D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2020 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 3040 26E2.tmp 2600 275E.tmp 2352 27DB.tmp 2624 2848.tmp 2808 28B6.tmp 2840 2932.tmp 2648 29A0.tmp 2608 2A1C.tmp 2788 2A8A.tmp 2524 2B06.tmp 2592 2B64.tmp 2164 2BE1.tmp 1884 2C3E.tmp 1052 2CAC.tmp 2748 2D09.tmp 1824 2D57.tmp 2736 2DC4.tmp 1832 2E41.tmp 1876 2EAE.tmp 676 2F0C.tmp 2760 2F6A.tmp 536 2FD7.tmp 788 3044.tmp 1092 3092.tmp 1352 30D0.tmp 1528 310F.tmp 1520 314D.tmp 2368 319B.tmp 2340 31DA.tmp 2732 3218.tmp 1084 3256.tmp 2148 32A4.tmp 2188 32E3.tmp 1632 3321.tmp 572 3360.tmp 540 33AE.tmp 2744 33EC.tmp 1792 343A.tmp 1148 3478.tmp 2488 34B7.tmp 2008 34F5.tmp 1388 3543.tmp 2012 3582.tmp 1364 35C0.tmp 1608 360E.tmp 2268 364C.tmp 972 368B.tmp 576 36D9.tmp 1932 3717.tmp 1980 3765.tmp 1188 37A4.tmp 396 37F2.tmp 1768 3830.tmp 2436 387E.tmp 1724 38BC.tmp 1600 38FB.tmp 3008 3939.tmp 2604 3978.tmp 2884 39B6.tmp 3020 3A04.tmp 2400 3A52.tmp 2668 3AA0.tmp 2624 3ADE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 3040 2020 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 28 PID 2020 wrote to memory of 3040 2020 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 28 PID 2020 wrote to memory of 3040 2020 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 28 PID 2020 wrote to memory of 3040 2020 2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe 28 PID 3040 wrote to memory of 2600 3040 26E2.tmp 29 PID 3040 wrote to memory of 2600 3040 26E2.tmp 29 PID 3040 wrote to memory of 2600 3040 26E2.tmp 29 PID 3040 wrote to memory of 2600 3040 26E2.tmp 29 PID 2600 wrote to memory of 2352 2600 275E.tmp 30 PID 2600 wrote to memory of 2352 2600 275E.tmp 30 PID 2600 wrote to memory of 2352 2600 275E.tmp 30 PID 2600 wrote to memory of 2352 2600 275E.tmp 30 PID 2352 wrote to memory of 2624 2352 27DB.tmp 31 PID 2352 wrote to memory of 2624 2352 27DB.tmp 31 PID 2352 wrote to memory of 2624 2352 27DB.tmp 31 PID 2352 wrote to memory of 2624 2352 27DB.tmp 31 PID 2624 wrote to memory of 2808 2624 2848.tmp 32 PID 2624 wrote to memory of 2808 2624 2848.tmp 32 PID 2624 wrote to memory of 2808 2624 2848.tmp 32 PID 2624 wrote to memory of 2808 2624 2848.tmp 32 PID 2808 wrote to memory of 2840 2808 28B6.tmp 33 PID 2808 wrote to memory of 2840 2808 28B6.tmp 33 PID 2808 wrote to memory of 2840 2808 28B6.tmp 33 PID 2808 wrote to memory of 2840 2808 28B6.tmp 33 PID 2840 wrote to memory of 2648 2840 2932.tmp 34 PID 2840 wrote to memory of 2648 2840 2932.tmp 34 PID 2840 wrote to memory of 2648 2840 2932.tmp 34 PID 2840 wrote to memory of 2648 2840 2932.tmp 34 PID 2648 wrote to memory of 2608 2648 29A0.tmp 35 PID 2648 wrote to memory of 2608 2648 29A0.tmp 35 PID 2648 wrote to memory of 2608 2648 29A0.tmp 35 PID 2648 wrote to memory of 2608 2648 29A0.tmp 35 PID 2608 wrote to memory of 2788 2608 2A1C.tmp 36 PID 2608 wrote to memory of 2788 2608 2A1C.tmp 36 PID 2608 wrote to memory of 2788 2608 2A1C.tmp 36 PID 2608 wrote to memory of 2788 2608 2A1C.tmp 36 PID 2788 wrote to memory of 2524 2788 2A8A.tmp 37 PID 2788 wrote to memory of 2524 2788 2A8A.tmp 37 PID 2788 wrote to memory of 2524 2788 2A8A.tmp 37 PID 2788 wrote to memory of 2524 2788 2A8A.tmp 37 PID 2524 wrote to memory of 2592 2524 2B06.tmp 38 PID 2524 wrote to memory of 2592 2524 2B06.tmp 38 PID 2524 wrote to memory of 2592 2524 2B06.tmp 38 PID 2524 wrote to memory of 2592 2524 2B06.tmp 38 PID 2592 wrote to memory of 2164 2592 2B64.tmp 39 PID 2592 wrote to memory of 2164 2592 2B64.tmp 39 PID 2592 wrote to memory of 2164 2592 2B64.tmp 39 PID 2592 wrote to memory of 2164 2592 2B64.tmp 39 PID 2164 wrote to memory of 1884 2164 2BE1.tmp 40 PID 2164 wrote to memory of 1884 2164 2BE1.tmp 40 PID 2164 wrote to memory of 1884 2164 2BE1.tmp 40 PID 2164 wrote to memory of 1884 2164 2BE1.tmp 40 PID 1884 wrote to memory of 1052 1884 2C3E.tmp 41 PID 1884 wrote to memory of 1052 1884 2C3E.tmp 41 PID 1884 wrote to memory of 1052 1884 2C3E.tmp 41 PID 1884 wrote to memory of 1052 1884 2C3E.tmp 41 PID 1052 wrote to memory of 2748 1052 2CAC.tmp 42 PID 1052 wrote to memory of 2748 1052 2CAC.tmp 42 PID 1052 wrote to memory of 2748 1052 2CAC.tmp 42 PID 1052 wrote to memory of 2748 1052 2CAC.tmp 42 PID 2748 wrote to memory of 1824 2748 2D09.tmp 43 PID 2748 wrote to memory of 1824 2748 2D09.tmp 43 PID 2748 wrote to memory of 1824 2748 2D09.tmp 43 PID 2748 wrote to memory of 1824 2748 2D09.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_b68a99d80b36af50307a1ef23c3365b3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\364C.tmp"C:\Users\Admin\AppData\Local\Temp\364C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"65⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"66⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"69⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"70⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"71⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"72⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"73⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"74⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"75⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"76⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"77⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"78⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"79⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"80⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"81⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"82⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"83⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"84⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"85⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"86⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"88⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"89⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"90⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"91⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"92⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\4200.tmp"C:\Users\Admin\AppData\Local\Temp\4200.tmp"93⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\423E.tmp"C:\Users\Admin\AppData\Local\Temp\423E.tmp"94⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"95⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"96⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"97⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"98⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"99⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"100⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"101⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"102⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"103⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"104⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"105⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"106⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"107⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"108⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"109⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"110⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"111⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"112⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"113⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\472E.tmp"C:\Users\Admin\AppData\Local\Temp\472E.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"115⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"116⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"117⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"118⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"119⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"120⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"121⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"122⤵PID:1808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-