Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_35452d781012974700df2626b39aad20_mafia.exe
-
Size
486KB
-
MD5
35452d781012974700df2626b39aad20
-
SHA1
be8941df932a1f8b02e482c557513e24c0db4958
-
SHA256
3409ef1139da9992754306357bc82f6cc9b88e84b60e6d3e205773e1fb3caba8
-
SHA512
60b29ba2a903dea957cbda55c5cba05c34751a423ef11132f94068824456decd82e23937b9e0bd08655c44c626835326daf28ece117549a9dca75499099759af
-
SSDEEP
12288:oU5rCOTeiDDHmZRmHH4rLKL0J/VdcqNZ:oUQOJDDmuHH4fK0JNdfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3040 7F1F.tmp 1428 8028.tmp 2756 8121.tmp 2760 822B.tmp 2832 8324.tmp 2788 843D.tmp 2744 8527.tmp 2212 8601.tmp 2572 86FB.tmp 2976 87E5.tmp 2996 88A0.tmp 1304 898A.tmp 1980 8A65.tmp 1748 8B20.tmp 1976 8C0A.tmp 2800 8D23.tmp 2888 8E0D.tmp 1948 8EE7.tmp 1224 8FC1.tmp 1280 90F9.tmp 1524 91C4.tmp 1988 92BE.tmp 1812 9389.tmp 2376 93F6.tmp 1632 9463.tmp 276 94E0.tmp 2656 955D.tmp 2332 95F9.tmp 596 9666.tmp 2928 96F2.tmp 1432 976F.tmp 2436 97EC.tmp 588 9878.tmp 2396 98F5.tmp 2356 9972.tmp 1496 99DF.tmp 1616 9A6B.tmp 1392 9AE8.tmp 976 9B55.tmp 112 9BC3.tmp 1836 9C3F.tmp 2476 9CBC.tmp 1548 9D29.tmp 852 9DA6.tmp 1152 9E13.tmp 840 9E90.tmp 1604 9EFD.tmp 2116 9F8A.tmp 1700 A016.tmp 1820 A083.tmp 1680 A0F1.tmp 2468 A15E.tmp 1768 A1DB.tmp 2532 A257.tmp 2136 A2D4.tmp 3052 A3AF.tmp 2672 A41C.tmp 2712 A4A8.tmp 2692 A525.tmp 2720 A592.tmp 2688 A6CA.tmp 2760 A7C4.tmp 2832 A831.tmp 2844 A8AE.tmp -
Loads dropped DLL 64 IoCs
pid Process 2288 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 3040 7F1F.tmp 1428 8028.tmp 2756 8121.tmp 2760 822B.tmp 2832 8324.tmp 2788 843D.tmp 2744 8527.tmp 2212 8601.tmp 2572 86FB.tmp 2976 87E5.tmp 2996 88A0.tmp 1304 898A.tmp 1980 8A65.tmp 1748 8B20.tmp 1976 8C0A.tmp 2800 8D23.tmp 2888 8E0D.tmp 1948 8EE7.tmp 1224 8FC1.tmp 1280 90F9.tmp 1524 91C4.tmp 1988 92BE.tmp 1812 9389.tmp 2376 93F6.tmp 1632 9463.tmp 276 94E0.tmp 2656 955D.tmp 2332 95F9.tmp 596 9666.tmp 2928 96F2.tmp 1432 976F.tmp 2436 97EC.tmp 588 9878.tmp 2396 98F5.tmp 2356 9972.tmp 1496 99DF.tmp 1616 9A6B.tmp 1392 9AE8.tmp 976 9B55.tmp 112 9BC3.tmp 1836 9C3F.tmp 2476 9CBC.tmp 1548 9D29.tmp 852 9DA6.tmp 1152 9E13.tmp 840 9E90.tmp 1604 9EFD.tmp 2116 9F8A.tmp 1700 A016.tmp 1820 A083.tmp 1680 A0F1.tmp 2468 A15E.tmp 1768 A1DB.tmp 2532 A257.tmp 1684 A332.tmp 3052 A3AF.tmp 2672 A41C.tmp 2712 A4A8.tmp 2692 A525.tmp 2720 A592.tmp 2688 A6CA.tmp 2760 A7C4.tmp 2832 A831.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2288 wrote to memory of 3040 2288 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 28 PID 2288 wrote to memory of 3040 2288 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 28 PID 2288 wrote to memory of 3040 2288 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 28 PID 2288 wrote to memory of 3040 2288 2024-01-23_35452d781012974700df2626b39aad20_mafia.exe 28 PID 3040 wrote to memory of 1428 3040 7F1F.tmp 29 PID 3040 wrote to memory of 1428 3040 7F1F.tmp 29 PID 3040 wrote to memory of 1428 3040 7F1F.tmp 29 PID 3040 wrote to memory of 1428 3040 7F1F.tmp 29 PID 1428 wrote to memory of 2756 1428 8028.tmp 30 PID 1428 wrote to memory of 2756 1428 8028.tmp 30 PID 1428 wrote to memory of 2756 1428 8028.tmp 30 PID 1428 wrote to memory of 2756 1428 8028.tmp 30 PID 2756 wrote to memory of 2760 2756 8121.tmp 31 PID 2756 wrote to memory of 2760 2756 8121.tmp 31 PID 2756 wrote to memory of 2760 2756 8121.tmp 31 PID 2756 wrote to memory of 2760 2756 8121.tmp 31 PID 2760 wrote to memory of 2832 2760 822B.tmp 32 PID 2760 wrote to memory of 2832 2760 822B.tmp 32 PID 2760 wrote to memory of 2832 2760 822B.tmp 32 PID 2760 wrote to memory of 2832 2760 822B.tmp 32 PID 2832 wrote to memory of 2788 2832 8324.tmp 33 PID 2832 wrote to memory of 2788 2832 8324.tmp 33 PID 2832 wrote to memory of 2788 2832 8324.tmp 33 PID 2832 wrote to memory of 2788 2832 8324.tmp 33 PID 2788 wrote to memory of 2744 2788 843D.tmp 34 PID 2788 wrote to memory of 2744 2788 843D.tmp 34 PID 2788 wrote to memory of 2744 2788 843D.tmp 34 PID 2788 wrote to memory of 2744 2788 843D.tmp 34 PID 2744 wrote to memory of 2212 2744 8527.tmp 35 PID 2744 wrote to memory of 2212 2744 8527.tmp 35 PID 2744 wrote to memory of 2212 2744 8527.tmp 35 PID 2744 wrote to memory of 2212 2744 8527.tmp 35 PID 2212 wrote to memory of 2572 2212 8601.tmp 36 PID 2212 wrote to memory of 2572 2212 8601.tmp 36 PID 2212 wrote to memory of 2572 2212 8601.tmp 36 PID 2212 wrote to memory of 2572 2212 8601.tmp 36 PID 2572 wrote to memory of 2976 2572 86FB.tmp 37 PID 2572 wrote to memory of 2976 2572 86FB.tmp 37 PID 2572 wrote to memory of 2976 2572 86FB.tmp 37 PID 2572 wrote to memory of 2976 2572 86FB.tmp 37 PID 2976 wrote to memory of 2996 2976 87E5.tmp 38 PID 2976 wrote to memory of 2996 2976 87E5.tmp 38 PID 2976 wrote to memory of 2996 2976 87E5.tmp 38 PID 2976 wrote to memory of 2996 2976 87E5.tmp 38 PID 2996 wrote to memory of 1304 2996 88A0.tmp 39 PID 2996 wrote to memory of 1304 2996 88A0.tmp 39 PID 2996 wrote to memory of 1304 2996 88A0.tmp 39 PID 2996 wrote to memory of 1304 2996 88A0.tmp 39 PID 1304 wrote to memory of 1980 1304 898A.tmp 40 PID 1304 wrote to memory of 1980 1304 898A.tmp 40 PID 1304 wrote to memory of 1980 1304 898A.tmp 40 PID 1304 wrote to memory of 1980 1304 898A.tmp 40 PID 1980 wrote to memory of 1748 1980 8A65.tmp 41 PID 1980 wrote to memory of 1748 1980 8A65.tmp 41 PID 1980 wrote to memory of 1748 1980 8A65.tmp 41 PID 1980 wrote to memory of 1748 1980 8A65.tmp 41 PID 1748 wrote to memory of 1976 1748 8B20.tmp 42 PID 1748 wrote to memory of 1976 1748 8B20.tmp 42 PID 1748 wrote to memory of 1976 1748 8B20.tmp 42 PID 1748 wrote to memory of 1976 1748 8B20.tmp 42 PID 1976 wrote to memory of 2800 1976 8C0A.tmp 43 PID 1976 wrote to memory of 2800 1976 8C0A.tmp 43 PID 1976 wrote to memory of 2800 1976 8C0A.tmp 43 PID 1976 wrote to memory of 2800 1976 8C0A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_35452d781012974700df2626b39aad20_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_35452d781012974700df2626b39aad20_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"C:\Users\Admin\AppData\Local\Temp\7F1F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\95F9.tmp"C:\Users\Admin\AppData\Local\Temp\95F9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\9972.tmp"C:\Users\Admin\AppData\Local\Temp\9972.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"C:\Users\Admin\AppData\Local\Temp\9C3F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"56⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"57⤵
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"66⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"67⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"68⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"69⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"70⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"71⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"72⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"73⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"74⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"75⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"76⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"77⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"78⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"79⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"80⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"81⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"82⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"83⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"84⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"85⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"86⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"87⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"88⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"89⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"90⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"91⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"92⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"93⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"94⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"95⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"96⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"97⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"98⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"99⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"100⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"101⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"102⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"103⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"104⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"105⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"106⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"107⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"108⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"109⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"110⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"111⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"112⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"113⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"114⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"115⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"116⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"117⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"118⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"119⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"120⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"121⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-