Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe
-
Size
712KB
-
MD5
46d8a178f6c015690e6c7a7ff83b59b3
-
SHA1
07af3656a1e624d5bbe669fe2fa13fc13f4d0dc6
-
SHA256
d9e024dafca91a29f469c5df10175f23873f9d40db907bc68563bd15d23cf5a6
-
SHA512
0f5c7000a275a17bffd1fd77947170868e400bd8d8ab57f1153a5e5d7c0f3c59c8c09762df3680ded643a13d33e6a894e1d4a6ebfeaecf84a8f5d105c2183730
-
SSDEEP
12288:FU5rCOTeiDhKNSmTxn2oSDnyPEJRNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDu2tLRJRNnCvq5TJLCvY90D8/L5
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2760 8A17.tmp 2516 8AE1.tmp 2572 8C19.tmp 2696 8D32.tmp 2548 8E0D.tmp 2540 8EA9.tmp 2512 8F93.tmp 2692 902F.tmp 2424 90BB.tmp 2488 9222.tmp 2736 930C.tmp 1004 9415.tmp 1552 9492.tmp 1400 959B.tmp 1860 96A4.tmp 904 97BD.tmp 2712 98D6.tmp 1276 99A1.tmp 1036 9B17.tmp 644 9C9D.tmp 1268 9DC5.tmp 1996 9F0D.tmp 1300 A026.tmp 2064 A100.tmp 1632 A18D.tmp 1484 A209.tmp 1756 A2A5.tmp 3028 A322.tmp 2612 A39F.tmp 2664 A41C.tmp 780 A4A8.tmp 3004 A535.tmp 476 A5B1.tmp 1152 A62E.tmp 320 A6BB.tmp 2004 A728.tmp 2072 A7B4.tmp 1096 A841.tmp 1028 A8AE.tmp 1376 A92B.tmp 1348 A9B7.tmp 1772 AA43.tmp 2984 AAB1.tmp 1664 AB4D.tmp 616 ABC9.tmp 2924 AC46.tmp 2276 ACC3.tmp 2108 AD4F.tmp 3048 ADEB.tmp 1616 AE68.tmp 872 AEE5.tmp 2316 AF62.tmp 1964 AFDF.tmp 2296 B25E.tmp 2748 B339.tmp 2144 B451.tmp 2308 B4FD.tmp 2972 B57A.tmp 2688 B635.tmp 2780 B6D1.tmp 2776 B75D.tmp 2576 B7CB.tmp 2708 B847.tmp 2772 B8C4.tmp -
Loads dropped DLL 64 IoCs
pid Process 1760 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 2760 8A17.tmp 2516 8AE1.tmp 2572 8C19.tmp 2696 8D32.tmp 2548 8E0D.tmp 2540 8EA9.tmp 2512 8F93.tmp 2692 902F.tmp 2424 90BB.tmp 2488 9222.tmp 2736 930C.tmp 1004 9415.tmp 1552 9492.tmp 1400 959B.tmp 1860 96A4.tmp 904 97BD.tmp 2712 98D6.tmp 1276 99A1.tmp 1036 9B17.tmp 644 9C9D.tmp 1268 9DC5.tmp 1996 9F0D.tmp 1300 A026.tmp 2064 A100.tmp 1632 A18D.tmp 1484 A209.tmp 1756 A2A5.tmp 3028 A322.tmp 2612 A39F.tmp 2664 A41C.tmp 780 A4A8.tmp 3004 A535.tmp 476 A5B1.tmp 1152 A62E.tmp 320 A6BB.tmp 2004 A728.tmp 2072 A7B4.tmp 1096 A841.tmp 1028 A8AE.tmp 1376 A92B.tmp 1348 A9B7.tmp 1772 AA43.tmp 2984 AAB1.tmp 1664 AB4D.tmp 616 ABC9.tmp 2924 AC46.tmp 2276 ACC3.tmp 2108 AD4F.tmp 3048 ADEB.tmp 1616 AE68.tmp 872 AEE5.tmp 2316 AF62.tmp 1964 AFDF.tmp 2296 B25E.tmp 2748 B339.tmp 2144 B451.tmp 2308 B4FD.tmp 2972 B57A.tmp 2688 B635.tmp 2780 B6D1.tmp 2776 B75D.tmp 2576 B7CB.tmp 2708 B847.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2760 1760 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 28 PID 1760 wrote to memory of 2760 1760 2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe 28 PID 2760 wrote to memory of 2516 2760 8A17.tmp 29 PID 2760 wrote to memory of 2516 2760 8A17.tmp 29 PID 2760 wrote to memory of 2516 2760 8A17.tmp 29 PID 2760 wrote to memory of 2516 2760 8A17.tmp 29 PID 2516 wrote to memory of 2572 2516 8AE1.tmp 30 PID 2516 wrote to memory of 2572 2516 8AE1.tmp 30 PID 2516 wrote to memory of 2572 2516 8AE1.tmp 30 PID 2516 wrote to memory of 2572 2516 8AE1.tmp 30 PID 2572 wrote to memory of 2696 2572 8C19.tmp 31 PID 2572 wrote to memory of 2696 2572 8C19.tmp 31 PID 2572 wrote to memory of 2696 2572 8C19.tmp 31 PID 2572 wrote to memory of 2696 2572 8C19.tmp 31 PID 2696 wrote to memory of 2548 2696 8D32.tmp 32 PID 2696 wrote to memory of 2548 2696 8D32.tmp 32 PID 2696 wrote to memory of 2548 2696 8D32.tmp 32 PID 2696 wrote to memory of 2548 2696 8D32.tmp 32 PID 2548 wrote to memory of 2540 2548 8E0D.tmp 33 PID 2548 wrote to memory of 2540 2548 8E0D.tmp 33 PID 2548 wrote to memory of 2540 2548 8E0D.tmp 33 PID 2548 wrote to memory of 2540 2548 8E0D.tmp 33 PID 2540 wrote to memory of 2512 2540 8EA9.tmp 34 PID 2540 wrote to memory of 2512 2540 8EA9.tmp 34 PID 2540 wrote to memory of 2512 2540 8EA9.tmp 34 PID 2540 wrote to memory of 2512 2540 8EA9.tmp 34 PID 2512 wrote to memory of 2692 2512 8F93.tmp 35 PID 2512 wrote to memory of 2692 2512 8F93.tmp 35 PID 2512 wrote to memory of 2692 2512 8F93.tmp 35 PID 2512 wrote to memory of 2692 2512 8F93.tmp 35 PID 2692 wrote to memory of 2424 2692 902F.tmp 36 PID 2692 wrote to memory of 2424 2692 902F.tmp 36 PID 2692 wrote to memory of 2424 2692 902F.tmp 36 PID 2692 wrote to memory of 2424 2692 902F.tmp 36 PID 2424 wrote to memory of 2488 2424 90BB.tmp 37 PID 2424 wrote to memory of 2488 2424 90BB.tmp 37 PID 2424 wrote to memory of 2488 2424 90BB.tmp 37 PID 2424 wrote to memory of 2488 2424 90BB.tmp 37 PID 2488 wrote to memory of 2736 2488 9222.tmp 38 PID 2488 wrote to memory of 2736 2488 9222.tmp 38 PID 2488 wrote to memory of 2736 2488 9222.tmp 38 PID 2488 wrote to memory of 2736 2488 9222.tmp 38 PID 2736 wrote to memory of 1004 2736 930C.tmp 39 PID 2736 wrote to memory of 1004 2736 930C.tmp 39 PID 2736 wrote to memory of 1004 2736 930C.tmp 39 PID 2736 wrote to memory of 1004 2736 930C.tmp 39 PID 1004 wrote to memory of 1552 1004 9415.tmp 40 PID 1004 wrote to memory of 1552 1004 9415.tmp 40 PID 1004 wrote to memory of 1552 1004 9415.tmp 40 PID 1004 wrote to memory of 1552 1004 9415.tmp 40 PID 1552 wrote to memory of 1400 1552 9492.tmp 41 PID 1552 wrote to memory of 1400 1552 9492.tmp 41 PID 1552 wrote to memory of 1400 1552 9492.tmp 41 PID 1552 wrote to memory of 1400 1552 9492.tmp 41 PID 1400 wrote to memory of 1860 1400 959B.tmp 42 PID 1400 wrote to memory of 1860 1400 959B.tmp 42 PID 1400 wrote to memory of 1860 1400 959B.tmp 42 PID 1400 wrote to memory of 1860 1400 959B.tmp 42 PID 1860 wrote to memory of 904 1860 96A4.tmp 43 PID 1860 wrote to memory of 904 1860 96A4.tmp 43 PID 1860 wrote to memory of 904 1860 96A4.tmp 43 PID 1860 wrote to memory of 904 1860 96A4.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_46d8a178f6c015690e6c7a7ff83b59b3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\8F93.tmp"C:\Users\Admin\AppData\Local\Temp\8F93.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\9492.tmp"C:\Users\Admin\AppData\Local\Temp\9492.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:644 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\AA43.tmp"C:\Users\Admin\AppData\Local\Temp\AA43.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"65⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"66⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"67⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"68⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"70⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"C:\Users\Admin\AppData\Local\Temp\BBA1.tmp"71⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"72⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"73⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"74⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"75⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"76⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"77⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"78⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"79⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"80⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"81⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"82⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"83⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"84⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"85⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"86⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"87⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"88⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"89⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"90⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"91⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"92⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"93⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"94⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\C967.tmp"C:\Users\Admin\AppData\Local\Temp\C967.tmp"95⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"C:\Users\Admin\AppData\Local\Temp\C9E4.tmp"96⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"97⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"98⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"99⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"100⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"102⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"103⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"104⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"105⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"106⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"107⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"108⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"109⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"110⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"111⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"112⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"113⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"114⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"115⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"116⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"117⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"118⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"119⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"120⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"121⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"122⤵PID:112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-