Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe
-
Size
541KB
-
MD5
08db09855429aad7ab2311950a37b901
-
SHA1
0fc13ba55986151a6fd83194da8fae71ea0814d8
-
SHA256
ddefeb189ed1d6f42e971107d90960d172b2239397c69ebcff73df5fdb8c8f9f
-
SHA512
f7e46d9d32bc390dd14ada4dc08615238494fa5f30c7a5c8cc0634cd62257296998f537bf3da1054a97ff0e3d54a97062cc5b90b00a3183c8302bdee5875ae42
-
SSDEEP
12288:UU5rCOTeifRDjSBYFCww5Nqo3JWxac696rZa73ctO:UUQOJf8eCnWxjrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1548 2896.tmp 2272 2913.tmp 2304 2990.tmp 2736 2A1C.tmp 2852 2A99.tmp 2712 2B26.tmp 2608 2BA2.tmp 2664 2C3E.tmp 2540 2CAC.tmp 2508 2D28.tmp 1260 2D76.tmp 2536 2DF3.tmp 1512 2E60.tmp 1848 2EDD.tmp 1612 2F3B.tmp 1488 2FA8.tmp 1920 3015.tmp 1984 30C1.tmp 2400 313E.tmp 2404 31CA.tmp 1492 3247.tmp 480 32C4.tmp 268 3331.tmp 344 336F.tmp 1796 33AE.tmp 2908 33EC.tmp 2792 342A.tmp 308 3478.tmp 2896 34C6.tmp 1144 3514.tmp 2848 3553.tmp 2136 3591.tmp 580 35D0.tmp 828 361E.tmp 1740 365C.tmp 2448 36AA.tmp 3016 36E8.tmp 1124 3736.tmp 2324 3784.tmp 2040 37C3.tmp 1284 3801.tmp 1800 384F.tmp 1344 388E.tmp 2872 38DC.tmp 2028 391A.tmp 892 3968.tmp 604 39A6.tmp 1516 39F4.tmp 2720 3A52.tmp 1704 3A90.tmp 2716 3ACF.tmp 1648 3B0D.tmp 880 3B4C.tmp 2980 3BA9.tmp 2960 3BE8.tmp 1560 3C26.tmp 1272 3C64.tmp 1716 3CA3.tmp 1696 3CE1.tmp 2596 3D2F.tmp 2640 3D7D.tmp 2336 3DBC.tmp 2744 3DFA.tmp 2696 3E48.tmp -
Loads dropped DLL 64 IoCs
pid Process 788 2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe 1548 2896.tmp 2272 2913.tmp 2304 2990.tmp 2736 2A1C.tmp 2852 2A99.tmp 2712 2B26.tmp 2608 2BA2.tmp 2664 2C3E.tmp 2540 2CAC.tmp 2508 2D28.tmp 1260 2D76.tmp 2536 2DF3.tmp 1512 2E60.tmp 1848 2EDD.tmp 1612 2F3B.tmp 1488 2FA8.tmp 1920 3015.tmp 1984 30C1.tmp 2400 313E.tmp 2404 31CA.tmp 1492 3247.tmp 480 32C4.tmp 268 3331.tmp 344 336F.tmp 1796 33AE.tmp 2908 33EC.tmp 2792 342A.tmp 308 3478.tmp 2896 34C6.tmp 1144 3514.tmp 2848 3553.tmp 2136 3591.tmp 580 35D0.tmp 828 361E.tmp 1740 365C.tmp 2448 36AA.tmp 3016 36E8.tmp 1124 3736.tmp 2324 3784.tmp 2040 37C3.tmp 1284 3801.tmp 1800 384F.tmp 1344 388E.tmp 2872 38DC.tmp 2028 391A.tmp 892 3968.tmp 604 39A6.tmp 1516 39F4.tmp 2720 3A52.tmp 1704 3A90.tmp 2716 3ACF.tmp 1648 3B0D.tmp 880 3B4C.tmp 2980 3BA9.tmp 2960 3BE8.tmp 1560 3C26.tmp 1272 3C64.tmp 1716 3CA3.tmp 1696 3CE1.tmp 2596 3D2F.tmp 2640 3D7D.tmp 2336 3DBC.tmp 2744 3DFA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 788 wrote to memory of 1548 788 2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe 28 PID 788 wrote to memory of 1548 788 2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe 28 PID 788 wrote to memory of 1548 788 2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe 28 PID 788 wrote to memory of 1548 788 2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe 28 PID 1548 wrote to memory of 2272 1548 2896.tmp 29 PID 1548 wrote to memory of 2272 1548 2896.tmp 29 PID 1548 wrote to memory of 2272 1548 2896.tmp 29 PID 1548 wrote to memory of 2272 1548 2896.tmp 29 PID 2272 wrote to memory of 2304 2272 2913.tmp 30 PID 2272 wrote to memory of 2304 2272 2913.tmp 30 PID 2272 wrote to memory of 2304 2272 2913.tmp 30 PID 2272 wrote to memory of 2304 2272 2913.tmp 30 PID 2304 wrote to memory of 2736 2304 2990.tmp 31 PID 2304 wrote to memory of 2736 2304 2990.tmp 31 PID 2304 wrote to memory of 2736 2304 2990.tmp 31 PID 2304 wrote to memory of 2736 2304 2990.tmp 31 PID 2736 wrote to memory of 2852 2736 2A1C.tmp 32 PID 2736 wrote to memory of 2852 2736 2A1C.tmp 32 PID 2736 wrote to memory of 2852 2736 2A1C.tmp 32 PID 2736 wrote to memory of 2852 2736 2A1C.tmp 32 PID 2852 wrote to memory of 2712 2852 2A99.tmp 33 PID 2852 wrote to memory of 2712 2852 2A99.tmp 33 PID 2852 wrote to memory of 2712 2852 2A99.tmp 33 PID 2852 wrote to memory of 2712 2852 2A99.tmp 33 PID 2712 wrote to memory of 2608 2712 2B26.tmp 34 PID 2712 wrote to memory of 2608 2712 2B26.tmp 34 PID 2712 wrote to memory of 2608 2712 2B26.tmp 34 PID 2712 wrote to memory of 2608 2712 2B26.tmp 34 PID 2608 wrote to memory of 2664 2608 2BA2.tmp 35 PID 2608 wrote to memory of 2664 2608 2BA2.tmp 35 PID 2608 wrote to memory of 2664 2608 2BA2.tmp 35 PID 2608 wrote to memory of 2664 2608 2BA2.tmp 35 PID 2664 wrote to memory of 2540 2664 2C3E.tmp 36 PID 2664 wrote to memory of 2540 2664 2C3E.tmp 36 PID 2664 wrote to memory of 2540 2664 2C3E.tmp 36 PID 2664 wrote to memory of 2540 2664 2C3E.tmp 36 PID 2540 wrote to memory of 2508 2540 2CAC.tmp 37 PID 2540 wrote to memory of 2508 2540 2CAC.tmp 37 PID 2540 wrote to memory of 2508 2540 2CAC.tmp 37 PID 2540 wrote to memory of 2508 2540 2CAC.tmp 37 PID 2508 wrote to memory of 1260 2508 2D28.tmp 38 PID 2508 wrote to memory of 1260 2508 2D28.tmp 38 PID 2508 wrote to memory of 1260 2508 2D28.tmp 38 PID 2508 wrote to memory of 1260 2508 2D28.tmp 38 PID 1260 wrote to memory of 2536 1260 2D76.tmp 39 PID 1260 wrote to memory of 2536 1260 2D76.tmp 39 PID 1260 wrote to memory of 2536 1260 2D76.tmp 39 PID 1260 wrote to memory of 2536 1260 2D76.tmp 39 PID 2536 wrote to memory of 1512 2536 2DF3.tmp 40 PID 2536 wrote to memory of 1512 2536 2DF3.tmp 40 PID 2536 wrote to memory of 1512 2536 2DF3.tmp 40 PID 2536 wrote to memory of 1512 2536 2DF3.tmp 40 PID 1512 wrote to memory of 1848 1512 2E60.tmp 41 PID 1512 wrote to memory of 1848 1512 2E60.tmp 41 PID 1512 wrote to memory of 1848 1512 2E60.tmp 41 PID 1512 wrote to memory of 1848 1512 2E60.tmp 41 PID 1848 wrote to memory of 1612 1848 2EDD.tmp 42 PID 1848 wrote to memory of 1612 1848 2EDD.tmp 42 PID 1848 wrote to memory of 1612 1848 2EDD.tmp 42 PID 1848 wrote to memory of 1612 1848 2EDD.tmp 42 PID 1612 wrote to memory of 1488 1612 2F3B.tmp 43 PID 1612 wrote to memory of 1488 1612 2F3B.tmp 43 PID 1612 wrote to memory of 1488 1612 2F3B.tmp 43 PID 1612 wrote to memory of 1488 1612 2F3B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_08db09855429aad7ab2311950a37b901_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"C:\Users\Admin\AppData\Local\Temp\3D2F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"66⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"67⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"68⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"69⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"70⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"71⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"72⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"73⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"74⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"75⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"76⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\4183.tmp"C:\Users\Admin\AppData\Local\Temp\4183.tmp"77⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"78⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"79⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"80⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"81⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"82⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"84⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"85⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"87⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"88⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"89⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"90⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"91⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"92⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\45B7.tmp"C:\Users\Admin\AppData\Local\Temp\45B7.tmp"93⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"94⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"95⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"96⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\46C0.tmp"C:\Users\Admin\AppData\Local\Temp\46C0.tmp"97⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"98⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"99⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\477C.tmp"C:\Users\Admin\AppData\Local\Temp\477C.tmp"100⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"101⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"102⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"103⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"104⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"105⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"106⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"107⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"108⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"109⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"110⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\4A59.tmp"C:\Users\Admin\AppData\Local\Temp\4A59.tmp"111⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"113⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\4B24.tmp"C:\Users\Admin\AppData\Local\Temp\4B24.tmp"114⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4B62.tmp"C:\Users\Admin\AppData\Local\Temp\4B62.tmp"115⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"116⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"117⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"118⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"C:\Users\Admin\AppData\Local\Temp\4C9A.tmp"120⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"121⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"122⤵PID:2428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-