Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe
-
Size
529KB
-
MD5
0ae8a64e3ea4a2a2cd22eec7a37a203a
-
SHA1
94378ced25fc925755f3e1bbc9e590afdab9dc65
-
SHA256
bfe57c41db43e9e915a6266dc42a93baa713d06dcd5351e9649ea64945c4669c
-
SHA512
f165a79e1c020d8d0b86038e61fe4e2ff4eb0e9a11ce6fca695a032af8f7f68a47c42228f9149b4941dd3a02cf126d03ec676f29770c2b46b0dba30e299aae8b
-
SSDEEP
12288:NU5rCOTeijS179unbwv/pplRST5jHZRuxTZwlH4Hp:NUQOJjGobwnvlAT5DuxTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2916 2971.tmp 2172 29DE.tmp 2792 2A4B.tmp 2156 2AA9.tmp 2580 2B06.tmp 2688 2B74.tmp 2644 2BE1.tmp 2548 2C3E.tmp 2776 2C9C.tmp 2544 2D19.tmp 2460 2D96.tmp 2884 2DF3.tmp 2888 2E60.tmp 1688 2ECE.tmp 2740 2F1C.tmp 2068 2F89.tmp 1332 2FE6.tmp 2396 3054.tmp 1652 30C1.tmp 1260 311E.tmp 1600 317C.tmp 596 31DA.tmp 792 3237.tmp 1668 3285.tmp 1552 32C4.tmp 648 3312.tmp 1784 3360.tmp 2932 339E.tmp 2880 33EC.tmp 1500 343A.tmp 2096 3478.tmp 1948 34C6.tmp 2060 3505.tmp 2276 3553.tmp 1868 3591.tmp 2516 35DF.tmp 1356 361E.tmp 712 366C.tmp 2384 36AA.tmp 3004 36F8.tmp 2092 3736.tmp 1692 3784.tmp 972 37C3.tmp 628 3801.tmp 1768 384F.tmp 1048 389D.tmp 952 38DC.tmp 2116 391A.tmp 1320 3968.tmp 2044 39A6.tmp 3012 39E5.tmp 1208 3A23.tmp 2008 3A62.tmp 2028 3AB0.tmp 292 3AEE.tmp 2864 3B3C.tmp 1760 3B7A.tmp 2928 3BB9.tmp 1756 3C07.tmp 1976 3C45.tmp 2720 3C84.tmp 2792 3CD2.tmp 2576 3D10.tmp 2680 3D4E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1740 2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe 2916 2971.tmp 2172 29DE.tmp 2792 2A4B.tmp 2156 2AA9.tmp 2580 2B06.tmp 2688 2B74.tmp 2644 2BE1.tmp 2548 2C3E.tmp 2776 2C9C.tmp 2544 2D19.tmp 2460 2D96.tmp 2884 2DF3.tmp 2888 2E60.tmp 1688 2ECE.tmp 2740 2F1C.tmp 2068 2F89.tmp 1332 2FE6.tmp 2396 3054.tmp 1652 30C1.tmp 1260 311E.tmp 1600 317C.tmp 596 31DA.tmp 792 3237.tmp 1668 3285.tmp 1552 32C4.tmp 648 3312.tmp 1784 3360.tmp 2932 339E.tmp 2880 33EC.tmp 1500 343A.tmp 2096 3478.tmp 1948 34C6.tmp 2060 3505.tmp 2276 3553.tmp 1868 3591.tmp 2516 35DF.tmp 1356 361E.tmp 712 366C.tmp 2384 36AA.tmp 3004 36F8.tmp 2092 3736.tmp 1692 3784.tmp 972 37C3.tmp 628 3801.tmp 1768 384F.tmp 1048 389D.tmp 952 38DC.tmp 2116 391A.tmp 1320 3968.tmp 2044 39A6.tmp 3012 39E5.tmp 1208 3A23.tmp 2008 3A62.tmp 2028 3AB0.tmp 292 3AEE.tmp 2864 3B3C.tmp 1760 3B7A.tmp 2928 3BB9.tmp 1756 3C07.tmp 1976 3C45.tmp 2720 3C84.tmp 2792 3CD2.tmp 2576 3D10.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2916 1740 2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe 28 PID 1740 wrote to memory of 2916 1740 2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe 28 PID 1740 wrote to memory of 2916 1740 2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe 28 PID 1740 wrote to memory of 2916 1740 2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe 28 PID 2916 wrote to memory of 2172 2916 2971.tmp 29 PID 2916 wrote to memory of 2172 2916 2971.tmp 29 PID 2916 wrote to memory of 2172 2916 2971.tmp 29 PID 2916 wrote to memory of 2172 2916 2971.tmp 29 PID 2172 wrote to memory of 2792 2172 29DE.tmp 30 PID 2172 wrote to memory of 2792 2172 29DE.tmp 30 PID 2172 wrote to memory of 2792 2172 29DE.tmp 30 PID 2172 wrote to memory of 2792 2172 29DE.tmp 30 PID 2792 wrote to memory of 2156 2792 2A4B.tmp 31 PID 2792 wrote to memory of 2156 2792 2A4B.tmp 31 PID 2792 wrote to memory of 2156 2792 2A4B.tmp 31 PID 2792 wrote to memory of 2156 2792 2A4B.tmp 31 PID 2156 wrote to memory of 2580 2156 2AA9.tmp 32 PID 2156 wrote to memory of 2580 2156 2AA9.tmp 32 PID 2156 wrote to memory of 2580 2156 2AA9.tmp 32 PID 2156 wrote to memory of 2580 2156 2AA9.tmp 32 PID 2580 wrote to memory of 2688 2580 2B06.tmp 33 PID 2580 wrote to memory of 2688 2580 2B06.tmp 33 PID 2580 wrote to memory of 2688 2580 2B06.tmp 33 PID 2580 wrote to memory of 2688 2580 2B06.tmp 33 PID 2688 wrote to memory of 2644 2688 2B74.tmp 34 PID 2688 wrote to memory of 2644 2688 2B74.tmp 34 PID 2688 wrote to memory of 2644 2688 2B74.tmp 34 PID 2688 wrote to memory of 2644 2688 2B74.tmp 34 PID 2644 wrote to memory of 2548 2644 2BE1.tmp 35 PID 2644 wrote to memory of 2548 2644 2BE1.tmp 35 PID 2644 wrote to memory of 2548 2644 2BE1.tmp 35 PID 2644 wrote to memory of 2548 2644 2BE1.tmp 35 PID 2548 wrote to memory of 2776 2548 2C3E.tmp 36 PID 2548 wrote to memory of 2776 2548 2C3E.tmp 36 PID 2548 wrote to memory of 2776 2548 2C3E.tmp 36 PID 2548 wrote to memory of 2776 2548 2C3E.tmp 36 PID 2776 wrote to memory of 2544 2776 2C9C.tmp 37 PID 2776 wrote to memory of 2544 2776 2C9C.tmp 37 PID 2776 wrote to memory of 2544 2776 2C9C.tmp 37 PID 2776 wrote to memory of 2544 2776 2C9C.tmp 37 PID 2544 wrote to memory of 2460 2544 2D19.tmp 38 PID 2544 wrote to memory of 2460 2544 2D19.tmp 38 PID 2544 wrote to memory of 2460 2544 2D19.tmp 38 PID 2544 wrote to memory of 2460 2544 2D19.tmp 38 PID 2460 wrote to memory of 2884 2460 2D96.tmp 39 PID 2460 wrote to memory of 2884 2460 2D96.tmp 39 PID 2460 wrote to memory of 2884 2460 2D96.tmp 39 PID 2460 wrote to memory of 2884 2460 2D96.tmp 39 PID 2884 wrote to memory of 2888 2884 2DF3.tmp 40 PID 2884 wrote to memory of 2888 2884 2DF3.tmp 40 PID 2884 wrote to memory of 2888 2884 2DF3.tmp 40 PID 2884 wrote to memory of 2888 2884 2DF3.tmp 40 PID 2888 wrote to memory of 1688 2888 2E60.tmp 41 PID 2888 wrote to memory of 1688 2888 2E60.tmp 41 PID 2888 wrote to memory of 1688 2888 2E60.tmp 41 PID 2888 wrote to memory of 1688 2888 2E60.tmp 41 PID 1688 wrote to memory of 2740 1688 2ECE.tmp 42 PID 1688 wrote to memory of 2740 1688 2ECE.tmp 42 PID 1688 wrote to memory of 2740 1688 2ECE.tmp 42 PID 1688 wrote to memory of 2740 1688 2ECE.tmp 42 PID 2740 wrote to memory of 2068 2740 2F1C.tmp 43 PID 2740 wrote to memory of 2068 2740 2F1C.tmp 43 PID 2740 wrote to memory of 2068 2740 2F1C.tmp 43 PID 2740 wrote to memory of 2068 2740 2F1C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_0ae8a64e3ea4a2a2cd22eec7a37a203a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\3478.tmp"C:\Users\Admin\AppData\Local\Temp\3478.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\3801.tmp"C:\Users\Admin\AppData\Local\Temp\3801.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"65⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"66⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"68⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"69⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"70⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"71⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"72⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"73⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"74⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"75⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"76⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"77⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"78⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4106.tmp"C:\Users\Admin\AppData\Local\Temp\4106.tmp"79⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"80⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"81⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\41D1.tmp"C:\Users\Admin\AppData\Local\Temp\41D1.tmp"82⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"83⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"84⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"85⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\42DA.tmp"C:\Users\Admin\AppData\Local\Temp\42DA.tmp"86⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\4318.tmp"C:\Users\Admin\AppData\Local\Temp\4318.tmp"87⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\4357.tmp"C:\Users\Admin\AppData\Local\Temp\4357.tmp"88⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"89⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"90⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"91⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"92⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"93⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"94⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"95⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"96⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\45C7.tmp"C:\Users\Admin\AppData\Local\Temp\45C7.tmp"97⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4605.tmp"C:\Users\Admin\AppData\Local\Temp\4605.tmp"98⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"99⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"100⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"101⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"103⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"105⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"106⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"107⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\48A4.tmp"C:\Users\Admin\AppData\Local\Temp\48A4.tmp"108⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\48F2.tmp"C:\Users\Admin\AppData\Local\Temp\48F2.tmp"109⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"110⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"111⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"112⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"113⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"114⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"115⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"116⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"117⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\4B52.tmp"C:\Users\Admin\AppData\Local\Temp\4B52.tmp"118⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"119⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"C:\Users\Admin\AppData\Local\Temp\4BCF.tmp"120⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"121⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-