Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe
-
Size
486KB
-
MD5
d0c356033845b94d6b9fd14a8a0b30ad
-
SHA1
8bc173c9e6151fc0b58777acc560debee17bda44
-
SHA256
1aafc309a5fd4a8ee450b0cf22c77a673611b69356fea860e6a97327bb904391
-
SHA512
7d58eac5d8ec0c4994e8ad47d48ca549fdd11568962a67ff10eb91badf9e34f713a2ff28b6b2b254fd623b0ec86067ee4004053fc7922b6abc2896bcc9efbfcb
-
SSDEEP
12288:/U5rCOTeiDRda1nGQBsWWFmGuTV+qS8pQRa8VmslTEBYNZ:/UQOJDRdenGHWWHkaRX1lTwYN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3064 77BF.tmp 2648 788A.tmp 2764 79D1.tmp 2684 7A9C.tmp 2700 7B57.tmp 2824 7BF3.tmp 2676 7D0C.tmp 1940 7DE7.tmp 2604 7EA2.tmp 3040 7F4D.tmp 592 8009.tmp 2520 80F3.tmp 380 81CD.tmp 576 8298.tmp 2900 8372.tmp 2332 845C.tmp 2324 8527.tmp 1484 85E2.tmp 2224 86AD.tmp 1156 8768.tmp 1488 8833.tmp 900 88FE.tmp 2832 8AB3.tmp 1576 8B3F.tmp 1092 8BCB.tmp 948 8C48.tmp 2636 8CD5.tmp 956 8D51.tmp 2948 8DBF.tmp 3052 8E2C.tmp 2328 8E99.tmp 2160 8F06.tmp 2940 8F64.tmp 2372 8FC1.tmp 1060 903E.tmp 2248 90BB.tmp 828 9128.tmp 2136 9195.tmp 984 91F3.tmp 1800 927F.tmp 944 92FC.tmp 2432 9389.tmp 2436 9425.tmp 2012 9492.tmp 284 94FF.tmp 2984 956C.tmp 2976 95CA.tmp 2504 9647.tmp 1928 96B4.tmp 1260 9711.tmp 2096 978E.tmp 1736 97FB.tmp 1744 9869.tmp 2088 98C6.tmp 1572 9943.tmp 1604 99C0.tmp 3064 9A2D.tmp 2756 9A9A.tmp 2784 9AF8.tmp 2748 9B65.tmp 2656 9BD2.tmp 2344 9C4F.tmp 2776 9CBC.tmp 2172 9D1A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2084 2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe 3064 77BF.tmp 2648 788A.tmp 2764 79D1.tmp 2684 7A9C.tmp 2700 7B57.tmp 2824 7BF3.tmp 2676 7D0C.tmp 1940 7DE7.tmp 2604 7EA2.tmp 3040 7F4D.tmp 592 8009.tmp 2520 80F3.tmp 380 81CD.tmp 576 8298.tmp 2900 8372.tmp 2332 845C.tmp 2324 8527.tmp 1484 85E2.tmp 2224 86AD.tmp 1156 8768.tmp 1488 8833.tmp 900 88FE.tmp 2832 8AB3.tmp 1576 8B3F.tmp 1092 8BCB.tmp 948 8C48.tmp 2636 8CD5.tmp 956 8D51.tmp 2948 8DBF.tmp 3052 8E2C.tmp 2328 8E99.tmp 2160 8F06.tmp 2940 8F64.tmp 2372 8FC1.tmp 1060 903E.tmp 2248 90BB.tmp 828 9128.tmp 2136 9195.tmp 984 91F3.tmp 1800 927F.tmp 944 92FC.tmp 2432 9389.tmp 2436 9425.tmp 2012 9492.tmp 284 94FF.tmp 2984 956C.tmp 2976 95CA.tmp 2504 9647.tmp 1928 96B4.tmp 1260 9711.tmp 2096 978E.tmp 1736 97FB.tmp 1744 9869.tmp 2088 98C6.tmp 1572 9943.tmp 1604 99C0.tmp 3064 9A2D.tmp 2756 9A9A.tmp 2784 9AF8.tmp 2748 9B65.tmp 2656 9BD2.tmp 2344 9C4F.tmp 2776 9CBC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 3064 2084 2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe 28 PID 2084 wrote to memory of 3064 2084 2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe 28 PID 2084 wrote to memory of 3064 2084 2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe 28 PID 2084 wrote to memory of 3064 2084 2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe 28 PID 3064 wrote to memory of 2648 3064 77BF.tmp 29 PID 3064 wrote to memory of 2648 3064 77BF.tmp 29 PID 3064 wrote to memory of 2648 3064 77BF.tmp 29 PID 3064 wrote to memory of 2648 3064 77BF.tmp 29 PID 2648 wrote to memory of 2764 2648 788A.tmp 30 PID 2648 wrote to memory of 2764 2648 788A.tmp 30 PID 2648 wrote to memory of 2764 2648 788A.tmp 30 PID 2648 wrote to memory of 2764 2648 788A.tmp 30 PID 2764 wrote to memory of 2684 2764 79D1.tmp 31 PID 2764 wrote to memory of 2684 2764 79D1.tmp 31 PID 2764 wrote to memory of 2684 2764 79D1.tmp 31 PID 2764 wrote to memory of 2684 2764 79D1.tmp 31 PID 2684 wrote to memory of 2700 2684 7A9C.tmp 32 PID 2684 wrote to memory of 2700 2684 7A9C.tmp 32 PID 2684 wrote to memory of 2700 2684 7A9C.tmp 32 PID 2684 wrote to memory of 2700 2684 7A9C.tmp 32 PID 2700 wrote to memory of 2824 2700 7B57.tmp 33 PID 2700 wrote to memory of 2824 2700 7B57.tmp 33 PID 2700 wrote to memory of 2824 2700 7B57.tmp 33 PID 2700 wrote to memory of 2824 2700 7B57.tmp 33 PID 2824 wrote to memory of 2676 2824 7BF3.tmp 34 PID 2824 wrote to memory of 2676 2824 7BF3.tmp 34 PID 2824 wrote to memory of 2676 2824 7BF3.tmp 34 PID 2824 wrote to memory of 2676 2824 7BF3.tmp 34 PID 2676 wrote to memory of 1940 2676 7D0C.tmp 35 PID 2676 wrote to memory of 1940 2676 7D0C.tmp 35 PID 2676 wrote to memory of 1940 2676 7D0C.tmp 35 PID 2676 wrote to memory of 1940 2676 7D0C.tmp 35 PID 1940 wrote to memory of 2604 1940 7DE7.tmp 36 PID 1940 wrote to memory of 2604 1940 7DE7.tmp 36 PID 1940 wrote to memory of 2604 1940 7DE7.tmp 36 PID 1940 wrote to memory of 2604 1940 7DE7.tmp 36 PID 2604 wrote to memory of 3040 2604 7EA2.tmp 37 PID 2604 wrote to memory of 3040 2604 7EA2.tmp 37 PID 2604 wrote to memory of 3040 2604 7EA2.tmp 37 PID 2604 wrote to memory of 3040 2604 7EA2.tmp 37 PID 3040 wrote to memory of 592 3040 7F4D.tmp 38 PID 3040 wrote to memory of 592 3040 7F4D.tmp 38 PID 3040 wrote to memory of 592 3040 7F4D.tmp 38 PID 3040 wrote to memory of 592 3040 7F4D.tmp 38 PID 592 wrote to memory of 2520 592 8009.tmp 39 PID 592 wrote to memory of 2520 592 8009.tmp 39 PID 592 wrote to memory of 2520 592 8009.tmp 39 PID 592 wrote to memory of 2520 592 8009.tmp 39 PID 2520 wrote to memory of 380 2520 80F3.tmp 40 PID 2520 wrote to memory of 380 2520 80F3.tmp 40 PID 2520 wrote to memory of 380 2520 80F3.tmp 40 PID 2520 wrote to memory of 380 2520 80F3.tmp 40 PID 380 wrote to memory of 576 380 81CD.tmp 41 PID 380 wrote to memory of 576 380 81CD.tmp 41 PID 380 wrote to memory of 576 380 81CD.tmp 41 PID 380 wrote to memory of 576 380 81CD.tmp 41 PID 576 wrote to memory of 2900 576 8298.tmp 42 PID 576 wrote to memory of 2900 576 8298.tmp 42 PID 576 wrote to memory of 2900 576 8298.tmp 42 PID 576 wrote to memory of 2900 576 8298.tmp 42 PID 2900 wrote to memory of 2332 2900 8372.tmp 43 PID 2900 wrote to memory of 2332 2900 8372.tmp 43 PID 2900 wrote to memory of 2332 2900 8372.tmp 43 PID 2900 wrote to memory of 2332 2900 8372.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-01_d0c356033845b94d6b9fd14a8a0b30ad_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\85E2.tmp"C:\Users\Admin\AppData\Local\Temp\85E2.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8E99.tmp"C:\Users\Admin\AppData\Local\Temp\8E99.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"65⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"66⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"67⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"68⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"69⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"70⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"71⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"72⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"73⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"74⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"75⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"76⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"77⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"78⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"79⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"80⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"81⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"82⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"83⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"84⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"85⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"86⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"88⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"89⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"90⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"91⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"92⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"93⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"94⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"95⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"96⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"97⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"98⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"99⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"100⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"102⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"103⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"104⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"105⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"106⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"107⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"108⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"109⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"110⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"111⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"112⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"113⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"114⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"115⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"116⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"117⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"118⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"119⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"120⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"121⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-