Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
02/08/2023, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
394b254123aaf89ed9459744bb67fc37_mafia_JC.exe
-
Size
486KB
-
MD5
394b254123aaf89ed9459744bb67fc37
-
SHA1
4fa6fad6f88b5ed4f843a8ceab497df6885466e0
-
SHA256
73f5022479040ced3a59356cad4cd4b648c0680dcb60e238f874c4f04cd3e517
-
SHA512
149285762a50189f9c021fd8f8020a7f0edbce5084be6ba6da9bc842a40b4bcaff2ddf07295a43bb136b00b16d7561b24ac8bb5d3b6fba838c63e77e09c1809c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7yG73wv20vIIhR7JXiGbepmBIBJzUpSRLW0Ga:/U5rCOTeiDye3RATyGozB4SRLhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1968 8B8D.tmp 2628 8BFA.tmp 2888 8D03.tmp 1064 8DFD.tmp 2968 8EF7.tmp 2160 8FD1.tmp 1988 90AB.tmp 2984 91A5.tmp 3008 928F.tmp 2872 9389.tmp 2696 9453.tmp 2824 953D.tmp 2484 9618.tmp 1528 9702.tmp 3064 978E.tmp 2124 9859.tmp 2040 9914.tmp 1956 99DF.tmp 2252 9A7B.tmp 1944 9B46.tmp 1672 9C20.tmp 1992 9E13.tmp 1520 9ECF.tmp 2936 9F2C.tmp 1688 9F99.tmp 276 A007.tmp 1068 A083.tmp 2356 A0E1.tmp 1728 A13F.tmp 284 A1AC.tmp 564 A229.tmp 1516 A296.tmp 268 A303.tmp 2676 A361.tmp 2800 A3BE.tmp 436 A44B.tmp 2308 A4A8.tmp 240 A4F6.tmp 1912 A573.tmp 288 A5F0.tmp 1816 A65D.tmp 1808 A6CA.tmp 1896 A737.tmp 2328 A7A5.tmp 760 A802.tmp 552 A860.tmp 2504 A8CD.tmp 2016 A93A.tmp 1748 A9B7.tmp 1080 AA05.tmp 2120 AA72.tmp 1620 AAFF.tmp 1084 AB7B.tmp 1600 ABD9.tmp 2420 AC27.tmp 2192 ACA4.tmp 2788 AD11.tmp 2100 AD8E.tmp 1628 ADFB.tmp 1092 AE59.tmp 2524 AEC6.tmp 2992 AF52.tmp 2860 AFBF.tmp 2856 B02D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2620 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 1968 8B8D.tmp 2628 8BFA.tmp 2888 8D03.tmp 1064 8DFD.tmp 2968 8EF7.tmp 2160 8FD1.tmp 1988 90AB.tmp 2984 91A5.tmp 3008 928F.tmp 2872 9389.tmp 2696 9453.tmp 2824 953D.tmp 2484 9618.tmp 1528 9702.tmp 3064 978E.tmp 2124 9859.tmp 2040 9914.tmp 1956 99DF.tmp 2252 9A7B.tmp 1944 9B46.tmp 1672 9C20.tmp 1992 9E13.tmp 1520 9ECF.tmp 2936 9F2C.tmp 1688 9F99.tmp 276 A007.tmp 1068 A083.tmp 2356 A0E1.tmp 1728 A13F.tmp 284 A1AC.tmp 564 A229.tmp 1516 A296.tmp 268 A303.tmp 2676 A361.tmp 2800 A3BE.tmp 436 A44B.tmp 2308 A4A8.tmp 240 A4F6.tmp 1912 A573.tmp 288 A5F0.tmp 1816 A65D.tmp 1808 A6CA.tmp 1896 A737.tmp 2328 A7A5.tmp 760 A802.tmp 552 A860.tmp 2504 A8CD.tmp 2016 A93A.tmp 1748 A9B7.tmp 1080 AA05.tmp 2120 AA72.tmp 1620 AAFF.tmp 1084 AB7B.tmp 1600 ABD9.tmp 2420 AC27.tmp 2192 ACA4.tmp 2788 AD11.tmp 2100 AD8E.tmp 1628 ADFB.tmp 1092 AE59.tmp 2524 AEC6.tmp 2992 AF52.tmp 2860 AFBF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1968 2620 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 28 PID 2620 wrote to memory of 1968 2620 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 28 PID 2620 wrote to memory of 1968 2620 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 28 PID 2620 wrote to memory of 1968 2620 394b254123aaf89ed9459744bb67fc37_mafia_JC.exe 28 PID 1968 wrote to memory of 2628 1968 8B8D.tmp 29 PID 1968 wrote to memory of 2628 1968 8B8D.tmp 29 PID 1968 wrote to memory of 2628 1968 8B8D.tmp 29 PID 1968 wrote to memory of 2628 1968 8B8D.tmp 29 PID 2628 wrote to memory of 2888 2628 8BFA.tmp 30 PID 2628 wrote to memory of 2888 2628 8BFA.tmp 30 PID 2628 wrote to memory of 2888 2628 8BFA.tmp 30 PID 2628 wrote to memory of 2888 2628 8BFA.tmp 30 PID 2888 wrote to memory of 1064 2888 8D03.tmp 31 PID 2888 wrote to memory of 1064 2888 8D03.tmp 31 PID 2888 wrote to memory of 1064 2888 8D03.tmp 31 PID 2888 wrote to memory of 1064 2888 8D03.tmp 31 PID 1064 wrote to memory of 2968 1064 8DFD.tmp 32 PID 1064 wrote to memory of 2968 1064 8DFD.tmp 32 PID 1064 wrote to memory of 2968 1064 8DFD.tmp 32 PID 1064 wrote to memory of 2968 1064 8DFD.tmp 32 PID 2968 wrote to memory of 2160 2968 8EF7.tmp 33 PID 2968 wrote to memory of 2160 2968 8EF7.tmp 33 PID 2968 wrote to memory of 2160 2968 8EF7.tmp 33 PID 2968 wrote to memory of 2160 2968 8EF7.tmp 33 PID 2160 wrote to memory of 1988 2160 8FD1.tmp 34 PID 2160 wrote to memory of 1988 2160 8FD1.tmp 34 PID 2160 wrote to memory of 1988 2160 8FD1.tmp 34 PID 2160 wrote to memory of 1988 2160 8FD1.tmp 34 PID 1988 wrote to memory of 2984 1988 90AB.tmp 35 PID 1988 wrote to memory of 2984 1988 90AB.tmp 35 PID 1988 wrote to memory of 2984 1988 90AB.tmp 35 PID 1988 wrote to memory of 2984 1988 90AB.tmp 35 PID 2984 wrote to memory of 3008 2984 91A5.tmp 36 PID 2984 wrote to memory of 3008 2984 91A5.tmp 36 PID 2984 wrote to memory of 3008 2984 91A5.tmp 36 PID 2984 wrote to memory of 3008 2984 91A5.tmp 36 PID 3008 wrote to memory of 2872 3008 928F.tmp 37 PID 3008 wrote to memory of 2872 3008 928F.tmp 37 PID 3008 wrote to memory of 2872 3008 928F.tmp 37 PID 3008 wrote to memory of 2872 3008 928F.tmp 37 PID 2872 wrote to memory of 2696 2872 9389.tmp 38 PID 2872 wrote to memory of 2696 2872 9389.tmp 38 PID 2872 wrote to memory of 2696 2872 9389.tmp 38 PID 2872 wrote to memory of 2696 2872 9389.tmp 38 PID 2696 wrote to memory of 2824 2696 9453.tmp 39 PID 2696 wrote to memory of 2824 2696 9453.tmp 39 PID 2696 wrote to memory of 2824 2696 9453.tmp 39 PID 2696 wrote to memory of 2824 2696 9453.tmp 39 PID 2824 wrote to memory of 2484 2824 953D.tmp 40 PID 2824 wrote to memory of 2484 2824 953D.tmp 40 PID 2824 wrote to memory of 2484 2824 953D.tmp 40 PID 2824 wrote to memory of 2484 2824 953D.tmp 40 PID 2484 wrote to memory of 1528 2484 9618.tmp 41 PID 2484 wrote to memory of 1528 2484 9618.tmp 41 PID 2484 wrote to memory of 1528 2484 9618.tmp 41 PID 2484 wrote to memory of 1528 2484 9618.tmp 41 PID 1528 wrote to memory of 3064 1528 9702.tmp 42 PID 1528 wrote to memory of 3064 1528 9702.tmp 42 PID 1528 wrote to memory of 3064 1528 9702.tmp 42 PID 1528 wrote to memory of 3064 1528 9702.tmp 42 PID 3064 wrote to memory of 2124 3064 978E.tmp 43 PID 3064 wrote to memory of 2124 3064 978E.tmp 43 PID 3064 wrote to memory of 2124 3064 978E.tmp 43 PID 3064 wrote to memory of 2124 3064 978E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\394b254123aaf89ed9459744bb67fc37_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\394b254123aaf89ed9459744bb67fc37_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\91A5.tmp"C:\Users\Admin\AppData\Local\Temp\91A5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:240 -
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\AA05.tmp"C:\Users\Admin\AppData\Local\Temp\AA05.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"65⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"66⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"67⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"68⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"69⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"70⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"71⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"72⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"73⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"74⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"75⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"76⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"77⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"78⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"79⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"80⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"81⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"82⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"83⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"84⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"85⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"86⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"87⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"88⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"89⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"90⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"92⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"93⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"94⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"95⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"96⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"97⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"98⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"99⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"100⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"101⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"102⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"103⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"104⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"105⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"106⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"107⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"108⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"109⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"110⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"111⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"113⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"114⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"115⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"116⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"117⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"118⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"119⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"120⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\CC15.tmp"C:\Users\Admin\AppData\Local\Temp\CC15.tmp"121⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"122⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-