Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
05/07/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe
-
Size
520KB
-
MD5
96336649e1e9ee2ac110f54f0e7cc75a
-
SHA1
bdd9403b7395847ca69f64937e05d66331e9740e
-
SHA256
dede675ac7947eb0acf331404f5c5fcfc20cb61340378a57f1aae66433c28851
-
SHA512
a5673822d91954fc5263f95d9ca041ff771832ec8737c464c82855bb270875b9a6c75893fba26a6ed05cb80c7211f260b3c10b0f0d54305b66bf65fe5588dedd
-
SSDEEP
12288:gj8fuxR21t5i8fjMpiM3HcgIcKcAPYK/iSfDXelJueaNZ:gj8fuK1GYjMpiMM3PYK/1uJueaN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2796 26D2.tmp 2956 2701.tmp 2572 273F.tmp 2708 277E.tmp 1192 27BC.tmp 2732 27FA.tmp 2172 2848.tmp 2928 2887.tmp 2716 28E4.tmp 2480 2932.tmp 2892 2990.tmp 2148 29CE.tmp 1540 2A0D.tmp 1688 2A4B.tmp 2532 2A99.tmp 748 2AD8.tmp 1592 2B26.tmp 1660 2B64.tmp 336 2BB2.tmp 784 2C1F.tmp 532 2C8C.tmp 1392 2CCB.tmp 1296 2D28.tmp 1724 2D76.tmp 2744 2DC4.tmp 1332 2DF3.tmp 2880 2E32.tmp 2656 2E80.tmp 3064 2EBE.tmp 2232 2EFC.tmp 828 2F3B.tmp 2528 2F79.tmp 1388 2FB8.tmp 1796 2FF6.tmp 1748 3034.tmp 2144 3073.tmp 3068 30B1.tmp 1092 30F0.tmp 2964 312E.tmp 2624 316C.tmp 1896 31AB.tmp 1576 31E9.tmp 916 3228.tmp 2916 3266.tmp 292 32A4.tmp 628 32E3.tmp 676 3321.tmp 2876 3350.tmp 1180 338E.tmp 3016 33CD.tmp 2856 340B.tmp 3008 344A.tmp 868 3488.tmp 824 34C6.tmp 3052 3505.tmp 1968 3543.tmp 2400 3582.tmp 2796 35C0.tmp 2668 35FE.tmp 2560 363D.tmp 2708 367B.tmp 1192 36AA.tmp 2636 36D9.tmp 2600 3717.tmp -
Loads dropped DLL 64 IoCs
pid Process 2400 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 2796 26D2.tmp 2956 2701.tmp 2572 273F.tmp 2708 277E.tmp 1192 27BC.tmp 2732 27FA.tmp 2172 2848.tmp 2928 2887.tmp 2716 28E4.tmp 2480 2932.tmp 2892 2990.tmp 2148 29CE.tmp 1540 2A0D.tmp 1688 2A4B.tmp 2532 2A99.tmp 748 2AD8.tmp 1592 2B26.tmp 1660 2B64.tmp 336 2BB2.tmp 784 2C1F.tmp 532 2C8C.tmp 1392 2CCB.tmp 1296 2D28.tmp 1724 2D76.tmp 2744 2DC4.tmp 1332 2DF3.tmp 2880 2E32.tmp 2656 2E80.tmp 3064 2EBE.tmp 2232 2EFC.tmp 828 2F3B.tmp 2528 2F79.tmp 1388 2FB8.tmp 1796 2FF6.tmp 1748 3034.tmp 2144 3073.tmp 3068 30B1.tmp 1092 30F0.tmp 2964 312E.tmp 2624 316C.tmp 1896 31AB.tmp 1576 31E9.tmp 916 3228.tmp 2916 3266.tmp 292 32A4.tmp 628 32E3.tmp 676 3321.tmp 2876 3350.tmp 1180 338E.tmp 3016 33CD.tmp 2856 340B.tmp 3008 344A.tmp 868 3488.tmp 824 34C6.tmp 3052 3505.tmp 1968 3543.tmp 2400 3582.tmp 2796 35C0.tmp 2668 35FE.tmp 2560 363D.tmp 2708 367B.tmp 1192 36AA.tmp 2636 36D9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2796 2400 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 28 PID 2400 wrote to memory of 2796 2400 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 28 PID 2400 wrote to memory of 2796 2400 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 28 PID 2400 wrote to memory of 2796 2400 2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe 28 PID 2796 wrote to memory of 2956 2796 26D2.tmp 29 PID 2796 wrote to memory of 2956 2796 26D2.tmp 29 PID 2796 wrote to memory of 2956 2796 26D2.tmp 29 PID 2796 wrote to memory of 2956 2796 26D2.tmp 29 PID 2956 wrote to memory of 2572 2956 2701.tmp 30 PID 2956 wrote to memory of 2572 2956 2701.tmp 30 PID 2956 wrote to memory of 2572 2956 2701.tmp 30 PID 2956 wrote to memory of 2572 2956 2701.tmp 30 PID 2572 wrote to memory of 2708 2572 273F.tmp 31 PID 2572 wrote to memory of 2708 2572 273F.tmp 31 PID 2572 wrote to memory of 2708 2572 273F.tmp 31 PID 2572 wrote to memory of 2708 2572 273F.tmp 31 PID 2708 wrote to memory of 1192 2708 277E.tmp 32 PID 2708 wrote to memory of 1192 2708 277E.tmp 32 PID 2708 wrote to memory of 1192 2708 277E.tmp 32 PID 2708 wrote to memory of 1192 2708 277E.tmp 32 PID 1192 wrote to memory of 2732 1192 27BC.tmp 33 PID 1192 wrote to memory of 2732 1192 27BC.tmp 33 PID 1192 wrote to memory of 2732 1192 27BC.tmp 33 PID 1192 wrote to memory of 2732 1192 27BC.tmp 33 PID 2732 wrote to memory of 2172 2732 27FA.tmp 34 PID 2732 wrote to memory of 2172 2732 27FA.tmp 34 PID 2732 wrote to memory of 2172 2732 27FA.tmp 34 PID 2732 wrote to memory of 2172 2732 27FA.tmp 34 PID 2172 wrote to memory of 2928 2172 2848.tmp 35 PID 2172 wrote to memory of 2928 2172 2848.tmp 35 PID 2172 wrote to memory of 2928 2172 2848.tmp 35 PID 2172 wrote to memory of 2928 2172 2848.tmp 35 PID 2928 wrote to memory of 2716 2928 2887.tmp 36 PID 2928 wrote to memory of 2716 2928 2887.tmp 36 PID 2928 wrote to memory of 2716 2928 2887.tmp 36 PID 2928 wrote to memory of 2716 2928 2887.tmp 36 PID 2716 wrote to memory of 2480 2716 28E4.tmp 37 PID 2716 wrote to memory of 2480 2716 28E4.tmp 37 PID 2716 wrote to memory of 2480 2716 28E4.tmp 37 PID 2716 wrote to memory of 2480 2716 28E4.tmp 37 PID 2480 wrote to memory of 2892 2480 2932.tmp 38 PID 2480 wrote to memory of 2892 2480 2932.tmp 38 PID 2480 wrote to memory of 2892 2480 2932.tmp 38 PID 2480 wrote to memory of 2892 2480 2932.tmp 38 PID 2892 wrote to memory of 2148 2892 2990.tmp 39 PID 2892 wrote to memory of 2148 2892 2990.tmp 39 PID 2892 wrote to memory of 2148 2892 2990.tmp 39 PID 2892 wrote to memory of 2148 2892 2990.tmp 39 PID 2148 wrote to memory of 1540 2148 29CE.tmp 40 PID 2148 wrote to memory of 1540 2148 29CE.tmp 40 PID 2148 wrote to memory of 1540 2148 29CE.tmp 40 PID 2148 wrote to memory of 1540 2148 29CE.tmp 40 PID 1540 wrote to memory of 1688 1540 2A0D.tmp 41 PID 1540 wrote to memory of 1688 1540 2A0D.tmp 41 PID 1540 wrote to memory of 1688 1540 2A0D.tmp 41 PID 1540 wrote to memory of 1688 1540 2A0D.tmp 41 PID 1688 wrote to memory of 2532 1688 2A4B.tmp 42 PID 1688 wrote to memory of 2532 1688 2A4B.tmp 42 PID 1688 wrote to memory of 2532 1688 2A4B.tmp 42 PID 1688 wrote to memory of 2532 1688 2A4B.tmp 42 PID 2532 wrote to memory of 748 2532 2A99.tmp 43 PID 2532 wrote to memory of 748 2532 2A99.tmp 43 PID 2532 wrote to memory of 748 2532 2A99.tmp 43 PID 2532 wrote to memory of 748 2532 2A99.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_96336649e1e9ee2ac110f54f0e7cc75a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"C:\Users\Admin\AppData\Local\Temp\2EFC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"C:\Users\Admin\AppData\Local\Temp\2F3B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"C:\Users\Admin\AppData\Local\Temp\2FB8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\30B1.tmp"C:\Users\Admin\AppData\Local\Temp\30B1.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\30F0.tmp"C:\Users\Admin\AppData\Local\Temp\30F0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"65⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"66⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"67⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"68⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\384F.tmp"C:\Users\Admin\AppData\Local\Temp\384F.tmp"70⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"71⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\38CC.tmp"C:\Users\Admin\AppData\Local\Temp\38CC.tmp"72⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"73⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\3939.tmp"C:\Users\Admin\AppData\Local\Temp\3939.tmp"74⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"75⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"76⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"77⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"78⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"79⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"80⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"81⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"C:\Users\Admin\AppData\Local\Temp\3B6B.tmp"82⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"83⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"84⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3C36.tmp"C:\Users\Admin\AppData\Local\Temp\3C36.tmp"85⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\3C93.tmp"C:\Users\Admin\AppData\Local\Temp\3C93.tmp"86⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"C:\Users\Admin\AppData\Local\Temp\3CD2.tmp"87⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"88⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"C:\Users\Admin\AppData\Local\Temp\3D7D.tmp"89⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"C:\Users\Admin\AppData\Local\Temp\3DBC.tmp"90⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"91⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"93⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"94⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"95⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"96⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"98⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\403B.tmp"C:\Users\Admin\AppData\Local\Temp\403B.tmp"99⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"100⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"101⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"102⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"103⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"104⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"105⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\41F0.tmp"C:\Users\Admin\AppData\Local\Temp\41F0.tmp"106⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\422E.tmp"C:\Users\Admin\AppData\Local\Temp\422E.tmp"107⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"108⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"109⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"110⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"111⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"112⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\43A5.tmp"C:\Users\Admin\AppData\Local\Temp\43A5.tmp"113⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"114⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"115⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\4460.tmp"C:\Users\Admin\AppData\Local\Temp\4460.tmp"116⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"117⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"118⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\451B.tmp"C:\Users\Admin\AppData\Local\Temp\451B.tmp"119⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"120⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"121⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-