Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
10/06/2024, 02:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe
-
Size
529KB
-
MD5
82767c29c51f33c2a8ef7a459875c122
-
SHA1
ffb3ff7dba2416c61d0be399e0fef141d0b4f9d2
-
SHA256
9b27126dd5f8f06f72d0a3c1f7cd704371a9b3b28ed895b52ac60d708e42382e
-
SHA512
8875326e7a70c02878ce4cc9d3d35a111620870d33af9dfe2e4495b644be987c4415cf8097cb2ccb4f3d88d115e336750c027f62f49aca82db3d950c3494e654
-
SSDEEP
12288:NU5rCOTeij57By5tbdc5Qjk9qmdrLlTZwlH4Hp:NUQOJjF45fA9q2XlTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2092 3237.tmp 2168 32A4.tmp 2320 3331.tmp 2732 337F.tmp 2728 340B.tmp 2644 3498.tmp 1900 3505.tmp 2536 3572.tmp 2680 35DF.tmp 2524 365C.tmp 2632 36C9.tmp 1796 3746.tmp 1712 37B3.tmp 2572 3830.tmp 2756 38AD.tmp 1204 3939.tmp 1624 39B6.tmp 1820 3A33.tmp 2164 3AA0.tmp 2240 3B1D.tmp 1692 3BA9.tmp 480 3C26.tmp 988 3C93.tmp 2208 3CD2.tmp 1840 3D20.tmp 756 3D6E.tmp 2876 3DAC.tmp 2884 3DEA.tmp 2956 3E29.tmp 2608 3E67.tmp 2776 3EA6.tmp 2692 3EE4.tmp 2312 3F22.tmp 1100 3F61.tmp 1372 3F9F.tmp 1836 3FED.tmp 636 402C.tmp 2336 406A.tmp 2368 40A8.tmp 2468 40F6.tmp 1784 4135.tmp 1536 4173.tmp 1300 41B2.tmp 1956 41F0.tmp 2940 422E.tmp 1728 427C.tmp 2272 42BB.tmp 2360 42F9.tmp 2964 4338.tmp 3016 4376.tmp 2896 43B4.tmp 1776 43F3.tmp 2260 4431.tmp 2220 447F.tmp 2480 44BE.tmp 1580 451B.tmp 1696 455A.tmp 2128 4598.tmp 2996 45D6.tmp 1832 4615.tmp 2724 4653.tmp 2320 4692.tmp 2732 46D0.tmp 2636 470E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1508 2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe 2092 3237.tmp 2168 32A4.tmp 2320 3331.tmp 2732 337F.tmp 2728 340B.tmp 2644 3498.tmp 1900 3505.tmp 2536 3572.tmp 2680 35DF.tmp 2524 365C.tmp 2632 36C9.tmp 1796 3746.tmp 1712 37B3.tmp 2572 3830.tmp 2756 38AD.tmp 1204 3939.tmp 1624 39B6.tmp 1820 3A33.tmp 2164 3AA0.tmp 2240 3B1D.tmp 1692 3BA9.tmp 480 3C26.tmp 988 3C93.tmp 2208 3CD2.tmp 1840 3D20.tmp 756 3D6E.tmp 2876 3DAC.tmp 2884 3DEA.tmp 2956 3E29.tmp 2608 3E67.tmp 2776 3EA6.tmp 2692 3EE4.tmp 2312 3F22.tmp 1100 3F61.tmp 1372 3F9F.tmp 1836 3FED.tmp 636 402C.tmp 2336 406A.tmp 2368 40A8.tmp 2468 40F6.tmp 1784 4135.tmp 1536 4173.tmp 1300 41B2.tmp 1956 41F0.tmp 2940 422E.tmp 1728 427C.tmp 2272 42BB.tmp 2360 42F9.tmp 2964 4338.tmp 3016 4376.tmp 2896 43B4.tmp 1776 43F3.tmp 2260 4431.tmp 2220 447F.tmp 2480 44BE.tmp 1580 451B.tmp 1696 455A.tmp 2128 4598.tmp 2996 45D6.tmp 1832 4615.tmp 2724 4653.tmp 2320 4692.tmp 2732 46D0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2092 1508 2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe 28 PID 1508 wrote to memory of 2092 1508 2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe 28 PID 1508 wrote to memory of 2092 1508 2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe 28 PID 1508 wrote to memory of 2092 1508 2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe 28 PID 2092 wrote to memory of 2168 2092 3237.tmp 29 PID 2092 wrote to memory of 2168 2092 3237.tmp 29 PID 2092 wrote to memory of 2168 2092 3237.tmp 29 PID 2092 wrote to memory of 2168 2092 3237.tmp 29 PID 2168 wrote to memory of 2320 2168 32A4.tmp 30 PID 2168 wrote to memory of 2320 2168 32A4.tmp 30 PID 2168 wrote to memory of 2320 2168 32A4.tmp 30 PID 2168 wrote to memory of 2320 2168 32A4.tmp 30 PID 2320 wrote to memory of 2732 2320 3331.tmp 31 PID 2320 wrote to memory of 2732 2320 3331.tmp 31 PID 2320 wrote to memory of 2732 2320 3331.tmp 31 PID 2320 wrote to memory of 2732 2320 3331.tmp 31 PID 2732 wrote to memory of 2728 2732 337F.tmp 32 PID 2732 wrote to memory of 2728 2732 337F.tmp 32 PID 2732 wrote to memory of 2728 2732 337F.tmp 32 PID 2732 wrote to memory of 2728 2732 337F.tmp 32 PID 2728 wrote to memory of 2644 2728 340B.tmp 33 PID 2728 wrote to memory of 2644 2728 340B.tmp 33 PID 2728 wrote to memory of 2644 2728 340B.tmp 33 PID 2728 wrote to memory of 2644 2728 340B.tmp 33 PID 2644 wrote to memory of 1900 2644 3498.tmp 34 PID 2644 wrote to memory of 1900 2644 3498.tmp 34 PID 2644 wrote to memory of 1900 2644 3498.tmp 34 PID 2644 wrote to memory of 1900 2644 3498.tmp 34 PID 1900 wrote to memory of 2536 1900 3505.tmp 35 PID 1900 wrote to memory of 2536 1900 3505.tmp 35 PID 1900 wrote to memory of 2536 1900 3505.tmp 35 PID 1900 wrote to memory of 2536 1900 3505.tmp 35 PID 2536 wrote to memory of 2680 2536 3572.tmp 36 PID 2536 wrote to memory of 2680 2536 3572.tmp 36 PID 2536 wrote to memory of 2680 2536 3572.tmp 36 PID 2536 wrote to memory of 2680 2536 3572.tmp 36 PID 2680 wrote to memory of 2524 2680 35DF.tmp 37 PID 2680 wrote to memory of 2524 2680 35DF.tmp 37 PID 2680 wrote to memory of 2524 2680 35DF.tmp 37 PID 2680 wrote to memory of 2524 2680 35DF.tmp 37 PID 2524 wrote to memory of 2632 2524 365C.tmp 38 PID 2524 wrote to memory of 2632 2524 365C.tmp 38 PID 2524 wrote to memory of 2632 2524 365C.tmp 38 PID 2524 wrote to memory of 2632 2524 365C.tmp 38 PID 2632 wrote to memory of 1796 2632 36C9.tmp 39 PID 2632 wrote to memory of 1796 2632 36C9.tmp 39 PID 2632 wrote to memory of 1796 2632 36C9.tmp 39 PID 2632 wrote to memory of 1796 2632 36C9.tmp 39 PID 1796 wrote to memory of 1712 1796 3746.tmp 40 PID 1796 wrote to memory of 1712 1796 3746.tmp 40 PID 1796 wrote to memory of 1712 1796 3746.tmp 40 PID 1796 wrote to memory of 1712 1796 3746.tmp 40 PID 1712 wrote to memory of 2572 1712 37B3.tmp 41 PID 1712 wrote to memory of 2572 1712 37B3.tmp 41 PID 1712 wrote to memory of 2572 1712 37B3.tmp 41 PID 1712 wrote to memory of 2572 1712 37B3.tmp 41 PID 2572 wrote to memory of 2756 2572 3830.tmp 42 PID 2572 wrote to memory of 2756 2572 3830.tmp 42 PID 2572 wrote to memory of 2756 2572 3830.tmp 42 PID 2572 wrote to memory of 2756 2572 3830.tmp 42 PID 2756 wrote to memory of 1204 2756 38AD.tmp 43 PID 2756 wrote to memory of 1204 2756 38AD.tmp 43 PID 2756 wrote to memory of 1204 2756 38AD.tmp 43 PID 2756 wrote to memory of 1204 2756 38AD.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_82767c29c51f33c2a8ef7a459875c122_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"C:\Users\Admin\AppData\Local\Temp\3DEA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"C:\Users\Admin\AppData\Local\Temp\3EA6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\427C.tmp"C:\Users\Admin\AppData\Local\Temp\427C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\42BB.tmp"C:\Users\Admin\AppData\Local\Temp\42BB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4376.tmp"C:\Users\Admin\AppData\Local\Temp\4376.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\44BE.tmp"C:\Users\Admin\AppData\Local\Temp\44BE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4653.tmp"C:\Users\Admin\AppData\Local\Temp\4653.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\4692.tmp"C:\Users\Admin\AppData\Local\Temp\4692.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\46D0.tmp"C:\Users\Admin\AppData\Local\Temp\46D0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\474D.tmp"C:\Users\Admin\AppData\Local\Temp\474D.tmp"66⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"67⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\47CA.tmp"C:\Users\Admin\AppData\Local\Temp\47CA.tmp"68⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"69⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"70⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"71⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"72⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"73⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"74⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"75⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"76⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"C:\Users\Admin\AppData\Local\Temp\4A0B.tmp"77⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\4A49.tmp"C:\Users\Admin\AppData\Local\Temp\4A49.tmp"78⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"79⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"80⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"81⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"82⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"83⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"84⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"C:\Users\Admin\AppData\Local\Temp\4BFE.tmp"85⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"86⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"87⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"88⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"89⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"90⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"91⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"C:\Users\Admin\AppData\Local\Temp\4DB3.tmp"92⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"93⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\4E30.tmp"C:\Users\Admin\AppData\Local\Temp\4E30.tmp"94⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"96⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"97⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"98⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"99⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"100⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"101⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\5032.tmp"C:\Users\Admin\AppData\Local\Temp\5032.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"103⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"104⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"105⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"106⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"107⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"108⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"110⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"111⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"112⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"113⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"114⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"115⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"116⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"117⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"118⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"119⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"120⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"121⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-