Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 18:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe
-
Size
488KB
-
MD5
7b97778ff9515f32542dbba3650c22c2
-
SHA1
e17b61e866876cebdde134eef9b8b393e43dd6bf
-
SHA256
6d557090a27bb0744160eed2e51459d18fcf7a433eb2238366088a04759d9231
-
SHA512
66eca310628c222c4f9abe92a90cdc7442c8aadf09c7602083e8e9e1d5ba9b5e91e7313d94729b2179e92d2869f798e9be5aa2c101351d1cb79c553e208061a9
-
SSDEEP
12288:/U5rCOTeiDlBySciL8KjA6nPEhhjn6xYp2SMNZ:/UQOJDPciL8KU6Pcz4YpTMN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2424 7E25.tmp 2876 7EA2.tmp 2700 7FCA.tmp 2348 80B4.tmp 1768 8150.tmp 2884 8259.tmp 2844 8343.tmp 2648 83DF.tmp 2152 848B.tmp 2576 8556.tmp 584 866F.tmp 2896 8759.tmp 2684 8823.tmp 988 88FE.tmp 1004 89C9.tmp 1660 8AB3.tmp 2500 8B5E.tmp 1244 8C77.tmp 1028 8D80.tmp 2664 8E5B.tmp 2824 8F06.tmp 1980 8FD1.tmp 1260 908C.tmp 1776 9E13.tmp 2556 A42B.tmp 2404 A65D.tmp 1380 A6BB.tmp 2132 A718.tmp 2448 A785.tmp 2444 A802.tmp 1312 A86F.tmp 1784 A8FC.tmp 608 A959.tmp 2456 A9B7.tmp 1472 AA24.tmp 1552 AAB1.tmp 1328 AB2D.tmp 2044 ABBA.tmp 2416 AC37.tmp 752 ACA4.tmp 1484 AD21.tmp 2004 AD8E.tmp 900 AE0B.tmp 2252 AE87.tmp 832 AF04.tmp 2216 AF71.tmp 3044 AFEE.tmp 3056 B05B.tmp 1724 B0D8.tmp 1148 B145.tmp 1564 B193.tmp 2316 B210.tmp 1792 B27D.tmp 1616 B2FA.tmp 2384 B367.tmp 2868 B3E4.tmp 2424 B471.tmp 2876 B4ED.tmp 2604 B56A.tmp 2948 B5D7.tmp 2944 B645.tmp 3024 B6C1.tmp 2624 B73E.tmp 2644 B7AB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2312 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 2424 7E25.tmp 2876 7EA2.tmp 2700 7FCA.tmp 2348 80B4.tmp 1768 8150.tmp 2884 8259.tmp 2844 8343.tmp 2648 83DF.tmp 2152 848B.tmp 2576 8556.tmp 584 866F.tmp 2896 8759.tmp 2684 8823.tmp 988 88FE.tmp 1004 89C9.tmp 1660 8AB3.tmp 2500 8B5E.tmp 1244 8C77.tmp 1028 8D80.tmp 2664 8E5B.tmp 2824 8F06.tmp 1980 8FD1.tmp 1260 908C.tmp 1776 9E13.tmp 2556 A42B.tmp 2404 A65D.tmp 1380 A6BB.tmp 2132 A718.tmp 2448 A785.tmp 2444 A802.tmp 1312 A86F.tmp 1784 A8FC.tmp 608 A959.tmp 2456 A9B7.tmp 1472 AA24.tmp 1552 AAB1.tmp 1328 AB2D.tmp 2044 ABBA.tmp 2416 AC37.tmp 752 ACA4.tmp 1484 AD21.tmp 2004 AD8E.tmp 900 AE0B.tmp 2252 AE87.tmp 832 AF04.tmp 2216 AF71.tmp 3044 AFEE.tmp 3056 B05B.tmp 1724 B0D8.tmp 1148 B145.tmp 1564 B193.tmp 2316 B210.tmp 1792 B27D.tmp 1616 B2FA.tmp 2384 B367.tmp 2868 B3E4.tmp 2424 B471.tmp 2876 B4ED.tmp 2604 B56A.tmp 2948 B5D7.tmp 2944 B645.tmp 3024 B6C1.tmp 2624 B73E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2424 2312 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 28 PID 2312 wrote to memory of 2424 2312 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 28 PID 2312 wrote to memory of 2424 2312 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 28 PID 2312 wrote to memory of 2424 2312 2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe 28 PID 2424 wrote to memory of 2876 2424 7E25.tmp 29 PID 2424 wrote to memory of 2876 2424 7E25.tmp 29 PID 2424 wrote to memory of 2876 2424 7E25.tmp 29 PID 2424 wrote to memory of 2876 2424 7E25.tmp 29 PID 2876 wrote to memory of 2700 2876 7EA2.tmp 30 PID 2876 wrote to memory of 2700 2876 7EA2.tmp 30 PID 2876 wrote to memory of 2700 2876 7EA2.tmp 30 PID 2876 wrote to memory of 2700 2876 7EA2.tmp 30 PID 2700 wrote to memory of 2348 2700 7FCA.tmp 31 PID 2700 wrote to memory of 2348 2700 7FCA.tmp 31 PID 2700 wrote to memory of 2348 2700 7FCA.tmp 31 PID 2700 wrote to memory of 2348 2700 7FCA.tmp 31 PID 2348 wrote to memory of 1768 2348 80B4.tmp 32 PID 2348 wrote to memory of 1768 2348 80B4.tmp 32 PID 2348 wrote to memory of 1768 2348 80B4.tmp 32 PID 2348 wrote to memory of 1768 2348 80B4.tmp 32 PID 1768 wrote to memory of 2884 1768 8150.tmp 33 PID 1768 wrote to memory of 2884 1768 8150.tmp 33 PID 1768 wrote to memory of 2884 1768 8150.tmp 33 PID 1768 wrote to memory of 2884 1768 8150.tmp 33 PID 2884 wrote to memory of 2844 2884 8259.tmp 34 PID 2884 wrote to memory of 2844 2884 8259.tmp 34 PID 2884 wrote to memory of 2844 2884 8259.tmp 34 PID 2884 wrote to memory of 2844 2884 8259.tmp 34 PID 2844 wrote to memory of 2648 2844 8343.tmp 35 PID 2844 wrote to memory of 2648 2844 8343.tmp 35 PID 2844 wrote to memory of 2648 2844 8343.tmp 35 PID 2844 wrote to memory of 2648 2844 8343.tmp 35 PID 2648 wrote to memory of 2152 2648 83DF.tmp 36 PID 2648 wrote to memory of 2152 2648 83DF.tmp 36 PID 2648 wrote to memory of 2152 2648 83DF.tmp 36 PID 2648 wrote to memory of 2152 2648 83DF.tmp 36 PID 2152 wrote to memory of 2576 2152 848B.tmp 37 PID 2152 wrote to memory of 2576 2152 848B.tmp 37 PID 2152 wrote to memory of 2576 2152 848B.tmp 37 PID 2152 wrote to memory of 2576 2152 848B.tmp 37 PID 2576 wrote to memory of 584 2576 8556.tmp 38 PID 2576 wrote to memory of 584 2576 8556.tmp 38 PID 2576 wrote to memory of 584 2576 8556.tmp 38 PID 2576 wrote to memory of 584 2576 8556.tmp 38 PID 584 wrote to memory of 2896 584 866F.tmp 39 PID 584 wrote to memory of 2896 584 866F.tmp 39 PID 584 wrote to memory of 2896 584 866F.tmp 39 PID 584 wrote to memory of 2896 584 866F.tmp 39 PID 2896 wrote to memory of 2684 2896 8759.tmp 40 PID 2896 wrote to memory of 2684 2896 8759.tmp 40 PID 2896 wrote to memory of 2684 2896 8759.tmp 40 PID 2896 wrote to memory of 2684 2896 8759.tmp 40 PID 2684 wrote to memory of 988 2684 8823.tmp 41 PID 2684 wrote to memory of 988 2684 8823.tmp 41 PID 2684 wrote to memory of 988 2684 8823.tmp 41 PID 2684 wrote to memory of 988 2684 8823.tmp 41 PID 988 wrote to memory of 1004 988 88FE.tmp 42 PID 988 wrote to memory of 1004 988 88FE.tmp 42 PID 988 wrote to memory of 1004 988 88FE.tmp 42 PID 988 wrote to memory of 1004 988 88FE.tmp 42 PID 1004 wrote to memory of 1660 1004 89C9.tmp 43 PID 1004 wrote to memory of 1660 1004 89C9.tmp 43 PID 1004 wrote to memory of 1660 1004 89C9.tmp 43 PID 1004 wrote to memory of 1660 1004 89C9.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_7b97778ff9515f32542dbba3650c22c2_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\A42B.tmp"C:\Users\Admin\AppData\Local\Temp\A42B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"C:\Users\Admin\AppData\Local\Temp\A8FC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"66⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"67⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"68⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"69⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"70⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"71⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"72⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"73⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"74⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"75⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"76⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"77⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"78⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"79⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"80⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"81⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"82⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"83⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"84⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"85⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"86⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"87⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"88⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"89⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"90⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"92⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"93⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"94⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"95⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"97⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"98⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"99⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"100⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"101⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"102⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"103⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"104⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"106⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"107⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"108⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"109⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"111⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"112⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"113⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"114⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"115⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"116⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"117⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"119⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"120⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"121⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"122⤵PID:1612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-