Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe
-
Size
520KB
-
MD5
29c967e8f49a897ebefa8d98bf4bff98
-
SHA1
e8d8d287d1b619ee54edbf3956d79acb3457b4b2
-
SHA256
30a025ae990e51fa008bec7ecbe307fd819e08eb38f214cdabd7d69f03f8a99d
-
SHA512
8edb54022990a2d32f2072fabcb15a723759202d492495dd2ab5a4ed813e6f403bed564917f3c54d0b136ba55e4baa4819f8c943d7b41af3510535b229818213
-
SSDEEP
12288:roRXOQjmOySUcULtboD7Ink8ylCG5w8qwvrjNZ:rogQ9yRcF7IkmiXN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2408 1E79.tmp 2216 1F05.tmp 2372 1FB1.tmp 2620 202E.tmp 2696 209B.tmp 3008 2108.tmp 2672 2166.tmp 2536 21C3.tmp 2556 2230.tmp 2504 229E.tmp 2580 232A.tmp 2560 2397.tmp 1796 2414.tmp 2972 2491.tmp 2968 250E.tmp 1364 258A.tmp 2756 2607.tmp 2484 2674.tmp 1448 2710.tmp 2760 277E.tmp 2004 27FA.tmp 1824 2868.tmp 812 28C5.tmp 1684 2913.tmp 2120 2961.tmp 2232 29AF.tmp 1296 29FD.tmp 2428 2A3C.tmp 3016 2A8A.tmp 1688 2AD8.tmp 532 2B26.tmp 536 2B74.tmp 2292 2BC2.tmp 1060 2C00.tmp 1096 2C4E.tmp 1404 2C8C.tmp 2480 2CDA.tmp 676 2D19.tmp 1504 2D67.tmp 1476 2DB5.tmp 2364 2DF3.tmp 1676 2E41.tmp 1984 2E80.tmp 492 2ECE.tmp 2356 2F0C.tmp 1936 2F4A.tmp 1944 2F89.tmp 1452 2FD7.tmp 1624 3015.tmp 556 3054.tmp 3036 3092.tmp 1396 30D0.tmp 880 311E.tmp 1064 318C.tmp 2016 31E9.tmp 2420 3237.tmp 1920 3276.tmp 1044 32C4.tmp 1864 3312.tmp 2128 3350.tmp 2376 339E.tmp 2640 33DC.tmp 2708 342A.tmp 2720 3469.tmp -
Loads dropped DLL 64 IoCs
pid Process 2220 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 2408 1E79.tmp 2216 1F05.tmp 2372 1FB1.tmp 2620 202E.tmp 2696 209B.tmp 3008 2108.tmp 2672 2166.tmp 2536 21C3.tmp 2556 2230.tmp 2504 229E.tmp 2580 232A.tmp 2560 2397.tmp 1796 2414.tmp 2972 2491.tmp 2968 250E.tmp 1364 258A.tmp 2756 2607.tmp 2484 2674.tmp 1448 2710.tmp 2760 277E.tmp 2004 27FA.tmp 1824 2868.tmp 812 28C5.tmp 1684 2913.tmp 2120 2961.tmp 2232 29AF.tmp 1296 29FD.tmp 2428 2A3C.tmp 3016 2A8A.tmp 1688 2AD8.tmp 532 2B26.tmp 536 2B74.tmp 2292 2BC2.tmp 1060 2C00.tmp 1096 2C4E.tmp 1404 2C8C.tmp 2480 2CDA.tmp 676 2D19.tmp 1504 2D67.tmp 1476 2DB5.tmp 2364 2DF3.tmp 1676 2E41.tmp 1984 2E80.tmp 492 2ECE.tmp 2356 2F0C.tmp 1936 2F4A.tmp 1944 2F89.tmp 1452 2FD7.tmp 1624 3015.tmp 556 3054.tmp 3036 3092.tmp 1396 30D0.tmp 880 311E.tmp 1064 318C.tmp 2016 31E9.tmp 2420 3237.tmp 1920 3276.tmp 1044 32C4.tmp 1864 3312.tmp 2128 3350.tmp 2376 339E.tmp 2640 33DC.tmp 2708 342A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2408 2220 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 28 PID 2220 wrote to memory of 2408 2220 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 28 PID 2220 wrote to memory of 2408 2220 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 28 PID 2220 wrote to memory of 2408 2220 2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe 28 PID 2408 wrote to memory of 2216 2408 1E79.tmp 29 PID 2408 wrote to memory of 2216 2408 1E79.tmp 29 PID 2408 wrote to memory of 2216 2408 1E79.tmp 29 PID 2408 wrote to memory of 2216 2408 1E79.tmp 29 PID 2216 wrote to memory of 2372 2216 1F05.tmp 30 PID 2216 wrote to memory of 2372 2216 1F05.tmp 30 PID 2216 wrote to memory of 2372 2216 1F05.tmp 30 PID 2216 wrote to memory of 2372 2216 1F05.tmp 30 PID 2372 wrote to memory of 2620 2372 1FB1.tmp 31 PID 2372 wrote to memory of 2620 2372 1FB1.tmp 31 PID 2372 wrote to memory of 2620 2372 1FB1.tmp 31 PID 2372 wrote to memory of 2620 2372 1FB1.tmp 31 PID 2620 wrote to memory of 2696 2620 202E.tmp 32 PID 2620 wrote to memory of 2696 2620 202E.tmp 32 PID 2620 wrote to memory of 2696 2620 202E.tmp 32 PID 2620 wrote to memory of 2696 2620 202E.tmp 32 PID 2696 wrote to memory of 3008 2696 209B.tmp 33 PID 2696 wrote to memory of 3008 2696 209B.tmp 33 PID 2696 wrote to memory of 3008 2696 209B.tmp 33 PID 2696 wrote to memory of 3008 2696 209B.tmp 33 PID 3008 wrote to memory of 2672 3008 2108.tmp 34 PID 3008 wrote to memory of 2672 3008 2108.tmp 34 PID 3008 wrote to memory of 2672 3008 2108.tmp 34 PID 3008 wrote to memory of 2672 3008 2108.tmp 34 PID 2672 wrote to memory of 2536 2672 2166.tmp 35 PID 2672 wrote to memory of 2536 2672 2166.tmp 35 PID 2672 wrote to memory of 2536 2672 2166.tmp 35 PID 2672 wrote to memory of 2536 2672 2166.tmp 35 PID 2536 wrote to memory of 2556 2536 21C3.tmp 36 PID 2536 wrote to memory of 2556 2536 21C3.tmp 36 PID 2536 wrote to memory of 2556 2536 21C3.tmp 36 PID 2536 wrote to memory of 2556 2536 21C3.tmp 36 PID 2556 wrote to memory of 2504 2556 2230.tmp 37 PID 2556 wrote to memory of 2504 2556 2230.tmp 37 PID 2556 wrote to memory of 2504 2556 2230.tmp 37 PID 2556 wrote to memory of 2504 2556 2230.tmp 37 PID 2504 wrote to memory of 2580 2504 229E.tmp 38 PID 2504 wrote to memory of 2580 2504 229E.tmp 38 PID 2504 wrote to memory of 2580 2504 229E.tmp 38 PID 2504 wrote to memory of 2580 2504 229E.tmp 38 PID 2580 wrote to memory of 2560 2580 232A.tmp 39 PID 2580 wrote to memory of 2560 2580 232A.tmp 39 PID 2580 wrote to memory of 2560 2580 232A.tmp 39 PID 2580 wrote to memory of 2560 2580 232A.tmp 39 PID 2560 wrote to memory of 1796 2560 2397.tmp 40 PID 2560 wrote to memory of 1796 2560 2397.tmp 40 PID 2560 wrote to memory of 1796 2560 2397.tmp 40 PID 2560 wrote to memory of 1796 2560 2397.tmp 40 PID 1796 wrote to memory of 2972 1796 2414.tmp 41 PID 1796 wrote to memory of 2972 1796 2414.tmp 41 PID 1796 wrote to memory of 2972 1796 2414.tmp 41 PID 1796 wrote to memory of 2972 1796 2414.tmp 41 PID 2972 wrote to memory of 2968 2972 2491.tmp 42 PID 2972 wrote to memory of 2968 2972 2491.tmp 42 PID 2972 wrote to memory of 2968 2972 2491.tmp 42 PID 2972 wrote to memory of 2968 2972 2491.tmp 42 PID 2968 wrote to memory of 1364 2968 250E.tmp 43 PID 2968 wrote to memory of 1364 2968 250E.tmp 43 PID 2968 wrote to memory of 1364 2968 250E.tmp 43 PID 2968 wrote to memory of 1364 2968 250E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_29c967e8f49a897ebefa8d98bf4bff98_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:492 -
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"65⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"67⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"68⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"69⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"70⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"71⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"72⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\369A.tmp"C:\Users\Admin\AppData\Local\Temp\369A.tmp"73⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"74⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"75⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"76⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"77⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"78⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"79⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"80⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"81⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"82⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"83⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"84⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3A04.tmp"C:\Users\Admin\AppData\Local\Temp\3A04.tmp"85⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3A42.tmp"C:\Users\Admin\AppData\Local\Temp\3A42.tmp"86⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3A81.tmp"C:\Users\Admin\AppData\Local\Temp\3A81.tmp"87⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"C:\Users\Admin\AppData\Local\Temp\3ABF.tmp"88⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"89⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"90⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"91⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"92⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"93⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\3C74.tmp"C:\Users\Admin\AppData\Local\Temp\3C74.tmp"94⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"95⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"96⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"97⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"98⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"99⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"100⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"101⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"103⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"104⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"105⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"106⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"107⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"108⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"109⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"110⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"111⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"112⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"113⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"114⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"115⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"116⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"118⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"119⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\43D4.tmp"C:\Users\Admin\AppData\Local\Temp\43D4.tmp"120⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"121⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"122⤵PID:324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-