Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 19:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe
-
Size
536KB
-
MD5
d513f32e23539f569616fff18e675a69
-
SHA1
fadddffdc8f000f4fed3b73093983907a743f872
-
SHA256
ba106fea70d3fa749212f5554339c8f46fafa329506c9c0393bf09fef4b4e7b1
-
SHA512
96e054d211148c942b7ca11080089651738b07227ea221a0a24e232d0344eb61dc6339ea815709b1b0b52fed6950a18848057282311c45c0d715cb19f1f4add3
-
SSDEEP
12288:wU5rCOTeiUZCZ2cQIQjIOaLV/ie+iQ5BDL9u1CuA7vIZxVJ0ZT9:wUQOJUc2cQPIOakBDIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2224 2108.tmp 2184 21B4.tmp 2052 2211.tmp 2640 2368.tmp 2104 23C6.tmp 2852 24C0.tmp 2788 255C.tmp 1984 2674.tmp 2508 274F.tmp 1480 281A.tmp 2180 2868.tmp 2924 28C5.tmp 2932 2923.tmp 2712 2980.tmp 1620 29DE.tmp 2024 2A3C.tmp 2680 2A99.tmp 320 2AF7.tmp 648 2B45.tmp 2284 2B93.tmp 1276 2BF0.tmp 1924 2C5E.tmp 2880 2CBB.tmp 2100 2D38.tmp 936 2D96.tmp 1648 2DF3.tmp 1864 2E60.tmp 1696 2EBE.tmp 1152 2F1C.tmp 1664 2F79.tmp 1384 2FE6.tmp 2352 3054.tmp 1876 30B1.tmp 1928 310F.tmp 2108 317C.tmp 1404 31E9.tmp 3032 3256.tmp 1656 32B4.tmp 2116 3321.tmp 1756 337F.tmp 1272 33FC.tmp 1612 3469.tmp 2012 34D6.tmp 2216 3534.tmp 2580 35A1.tmp 2144 35FE.tmp 2636 366C.tmp 2656 36D9.tmp 2560 3736.tmp 2132 3794.tmp 2468 37F2.tmp 2660 384F.tmp 2464 38DC.tmp 1836 3939.tmp 2492 3987.tmp 2448 39E5.tmp 2928 3A42.tmp 2984 3ADE.tmp 2936 3B3C.tmp 2536 3B8A.tmp 1096 3BD8.tmp 3000 3C64.tmp 696 3CB2.tmp 2688 3D20.tmp -
Loads dropped DLL 64 IoCs
pid Process 2408 2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe 2224 2108.tmp 2184 21B4.tmp 2052 2211.tmp 2640 2368.tmp 2104 23C6.tmp 2852 24C0.tmp 2788 255C.tmp 1984 2674.tmp 2508 274F.tmp 1480 281A.tmp 2180 2868.tmp 2924 28C5.tmp 2932 2923.tmp 2712 2980.tmp 1620 29DE.tmp 2024 2A3C.tmp 2680 2A99.tmp 320 2AF7.tmp 648 2B45.tmp 2284 2B93.tmp 1276 2BF0.tmp 1924 2C5E.tmp 2880 2CBB.tmp 2100 2D38.tmp 936 2D96.tmp 1648 2DF3.tmp 1864 2E60.tmp 1696 2EBE.tmp 1152 2F1C.tmp 1664 2F79.tmp 1384 2FE6.tmp 2352 3054.tmp 1876 30B1.tmp 1928 310F.tmp 2108 317C.tmp 1404 31E9.tmp 3032 3256.tmp 1656 32B4.tmp 2116 3321.tmp 1756 337F.tmp 1272 33FC.tmp 1612 3469.tmp 2012 34D6.tmp 2216 3534.tmp 2580 35A1.tmp 2144 35FE.tmp 2636 366C.tmp 2656 36D9.tmp 2560 3736.tmp 2132 3794.tmp 2468 37F2.tmp 2660 384F.tmp 2464 38DC.tmp 1836 3939.tmp 2492 3987.tmp 2448 39E5.tmp 2928 3A42.tmp 2984 3ADE.tmp 2936 3B3C.tmp 2536 3B8A.tmp 1096 3BD8.tmp 3000 3C64.tmp 696 3CB2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2224 2408 2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe 28 PID 2408 wrote to memory of 2224 2408 2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe 28 PID 2408 wrote to memory of 2224 2408 2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe 28 PID 2408 wrote to memory of 2224 2408 2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe 28 PID 2224 wrote to memory of 2184 2224 2108.tmp 29 PID 2224 wrote to memory of 2184 2224 2108.tmp 29 PID 2224 wrote to memory of 2184 2224 2108.tmp 29 PID 2224 wrote to memory of 2184 2224 2108.tmp 29 PID 2184 wrote to memory of 2052 2184 21B4.tmp 30 PID 2184 wrote to memory of 2052 2184 21B4.tmp 30 PID 2184 wrote to memory of 2052 2184 21B4.tmp 30 PID 2184 wrote to memory of 2052 2184 21B4.tmp 30 PID 2052 wrote to memory of 2640 2052 2211.tmp 31 PID 2052 wrote to memory of 2640 2052 2211.tmp 31 PID 2052 wrote to memory of 2640 2052 2211.tmp 31 PID 2052 wrote to memory of 2640 2052 2211.tmp 31 PID 2640 wrote to memory of 2104 2640 2368.tmp 32 PID 2640 wrote to memory of 2104 2640 2368.tmp 32 PID 2640 wrote to memory of 2104 2640 2368.tmp 32 PID 2640 wrote to memory of 2104 2640 2368.tmp 32 PID 2104 wrote to memory of 2852 2104 23C6.tmp 33 PID 2104 wrote to memory of 2852 2104 23C6.tmp 33 PID 2104 wrote to memory of 2852 2104 23C6.tmp 33 PID 2104 wrote to memory of 2852 2104 23C6.tmp 33 PID 2852 wrote to memory of 2788 2852 24C0.tmp 34 PID 2852 wrote to memory of 2788 2852 24C0.tmp 34 PID 2852 wrote to memory of 2788 2852 24C0.tmp 34 PID 2852 wrote to memory of 2788 2852 24C0.tmp 34 PID 2788 wrote to memory of 1984 2788 255C.tmp 35 PID 2788 wrote to memory of 1984 2788 255C.tmp 35 PID 2788 wrote to memory of 1984 2788 255C.tmp 35 PID 2788 wrote to memory of 1984 2788 255C.tmp 35 PID 1984 wrote to memory of 2508 1984 2674.tmp 36 PID 1984 wrote to memory of 2508 1984 2674.tmp 36 PID 1984 wrote to memory of 2508 1984 2674.tmp 36 PID 1984 wrote to memory of 2508 1984 2674.tmp 36 PID 2508 wrote to memory of 1480 2508 274F.tmp 37 PID 2508 wrote to memory of 1480 2508 274F.tmp 37 PID 2508 wrote to memory of 1480 2508 274F.tmp 37 PID 2508 wrote to memory of 1480 2508 274F.tmp 37 PID 1480 wrote to memory of 2180 1480 281A.tmp 38 PID 1480 wrote to memory of 2180 1480 281A.tmp 38 PID 1480 wrote to memory of 2180 1480 281A.tmp 38 PID 1480 wrote to memory of 2180 1480 281A.tmp 38 PID 2180 wrote to memory of 2924 2180 2868.tmp 39 PID 2180 wrote to memory of 2924 2180 2868.tmp 39 PID 2180 wrote to memory of 2924 2180 2868.tmp 39 PID 2180 wrote to memory of 2924 2180 2868.tmp 39 PID 2924 wrote to memory of 2932 2924 28C5.tmp 40 PID 2924 wrote to memory of 2932 2924 28C5.tmp 40 PID 2924 wrote to memory of 2932 2924 28C5.tmp 40 PID 2924 wrote to memory of 2932 2924 28C5.tmp 40 PID 2932 wrote to memory of 2712 2932 2923.tmp 41 PID 2932 wrote to memory of 2712 2932 2923.tmp 41 PID 2932 wrote to memory of 2712 2932 2923.tmp 41 PID 2932 wrote to memory of 2712 2932 2923.tmp 41 PID 2712 wrote to memory of 1620 2712 2980.tmp 42 PID 2712 wrote to memory of 1620 2712 2980.tmp 42 PID 2712 wrote to memory of 1620 2712 2980.tmp 42 PID 2712 wrote to memory of 1620 2712 2980.tmp 42 PID 1620 wrote to memory of 2024 1620 29DE.tmp 43 PID 1620 wrote to memory of 2024 1620 29DE.tmp 43 PID 1620 wrote to memory of 2024 1620 29DE.tmp 43 PID 1620 wrote to memory of 2024 1620 29DE.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_d513f32e23539f569616fff18e675a69_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"65⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"66⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"67⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"68⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"69⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"70⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"71⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"72⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"73⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"74⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\4089.tmp"C:\Users\Admin\AppData\Local\Temp\4089.tmp"75⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"76⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"77⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"78⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"79⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"80⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"81⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"82⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"83⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"84⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"85⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"86⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"87⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"88⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"89⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"90⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"91⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\454A.tmp"C:\Users\Admin\AppData\Local\Temp\454A.tmp"92⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"93⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"94⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"95⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"96⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"97⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"98⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"99⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"100⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\47AA.tmp"C:\Users\Admin\AppData\Local\Temp\47AA.tmp"101⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"102⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"103⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"104⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"105⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4911.tmp"C:\Users\Admin\AppData\Local\Temp\4911.tmp"106⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"107⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"108⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\49DC.tmp"C:\Users\Admin\AppData\Local\Temp\49DC.tmp"109⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"110⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"111⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"112⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"113⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"114⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"115⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"116⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"117⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"118⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"119⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"120⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"121⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-