Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/04/2024, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe
-
Size
488KB
-
MD5
914b9c55d125f4f516230aa71c2fe370
-
SHA1
b896386ca670438e3b0dea3a07271f5ffb1d5451
-
SHA256
bd2e42a592a583938b3f9caf42c505f1f2d0acdd4a1ff3308364d0bcba799115
-
SHA512
c4ca49a8109f8983ff1fcad40397dde1cf7ffbb3f54cbd19943d370e99f5347a24e0de353bdd79fb666a06936a2cafd0c6377f882b6a978fa8af2d3b8c8c741e
-
SSDEEP
12288:/U5rCOTeiDC6lbRGsQtMC0KYW5v5tjMRNZ:/UQOJD7O0XKYSzaN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2224 8A36.tmp 2532 8B10.tmp 2916 8C39.tmp 2564 8D13.tmp 3064 8DFD.tmp 2636 8F06.tmp 2160 8FD1.tmp 2828 909C.tmp 2400 9138.tmp 2364 9212.tmp 2832 930C.tmp 2156 93C7.tmp 856 94A1.tmp 960 956C.tmp 1760 9627.tmp 2640 9750.tmp 2684 9849.tmp 2968 9924.tmp 2040 9A0E.tmp 1080 9AF8.tmp 1252 9C8D.tmp 1168 9DD5.tmp 1556 9E90.tmp 540 9EFD.tmp 620 9F7A.tmp 804 A016.tmp 1680 A0A3.tmp 2260 A11F.tmp 1204 A1AC.tmp 2024 A229.tmp 1552 A2B5.tmp 664 A332.tmp 2860 A3AF.tmp 1764 A43B.tmp 2252 A4B8.tmp 2208 A535.tmp 3016 A5A2.tmp 1284 A63E.tmp 696 A6BB.tmp 1780 A737.tmp 1000 A7C4.tmp 1540 A850.tmp 2908 A8DD.tmp 1964 A969.tmp 748 A9F5.tmp 552 AA82.tmp 2912 AB0E.tmp 1708 AB8B.tmp 1636 AC27.tmp 2416 ACA4.tmp 2232 AD21.tmp 2816 AD8E.tmp 2288 AE0B.tmp 1580 AEA7.tmp 1544 AFA0.tmp 2856 B01D.tmp 2884 B0B9.tmp 2688 B201.tmp 2552 B28D.tmp 2712 B319.tmp 2456 B3A6.tmp 2492 B413.tmp 2624 B480.tmp 2660 B50D.tmp -
Loads dropped DLL 64 IoCs
pid Process 1544 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 2224 8A36.tmp 2532 8B10.tmp 2916 8C39.tmp 2564 8D13.tmp 3064 8DFD.tmp 2636 8F06.tmp 2160 8FD1.tmp 2828 909C.tmp 2400 9138.tmp 2364 9212.tmp 2832 930C.tmp 2156 93C7.tmp 856 94A1.tmp 960 956C.tmp 1760 9627.tmp 2640 9750.tmp 2684 9849.tmp 2968 9924.tmp 2040 9A0E.tmp 1080 9AF8.tmp 1252 9C8D.tmp 1168 9DD5.tmp 1556 9E90.tmp 540 9EFD.tmp 620 9F7A.tmp 804 A016.tmp 1680 A0A3.tmp 2260 A11F.tmp 1204 A1AC.tmp 2024 A229.tmp 1552 A2B5.tmp 664 A332.tmp 2860 A3AF.tmp 1764 A43B.tmp 2252 A4B8.tmp 2208 A535.tmp 3016 A5A2.tmp 1284 A63E.tmp 696 A6BB.tmp 1780 A737.tmp 1000 A7C4.tmp 1540 A850.tmp 2908 A8DD.tmp 1964 A969.tmp 748 A9F5.tmp 552 AA82.tmp 2912 AB0E.tmp 1708 AB8B.tmp 1636 AC27.tmp 2416 ACA4.tmp 2232 AD21.tmp 2816 AD8E.tmp 2288 AE0B.tmp 1692 AF23.tmp 1544 AFA0.tmp 2856 B01D.tmp 2884 B0B9.tmp 2688 B201.tmp 2552 B28D.tmp 2712 B319.tmp 2456 B3A6.tmp 2492 B413.tmp 2624 B480.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 2224 1544 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 28 PID 1544 wrote to memory of 2224 1544 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 28 PID 1544 wrote to memory of 2224 1544 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 28 PID 1544 wrote to memory of 2224 1544 2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe 28 PID 2224 wrote to memory of 2532 2224 8A36.tmp 29 PID 2224 wrote to memory of 2532 2224 8A36.tmp 29 PID 2224 wrote to memory of 2532 2224 8A36.tmp 29 PID 2224 wrote to memory of 2532 2224 8A36.tmp 29 PID 2532 wrote to memory of 2916 2532 8B10.tmp 30 PID 2532 wrote to memory of 2916 2532 8B10.tmp 30 PID 2532 wrote to memory of 2916 2532 8B10.tmp 30 PID 2532 wrote to memory of 2916 2532 8B10.tmp 30 PID 2916 wrote to memory of 2564 2916 8C39.tmp 31 PID 2916 wrote to memory of 2564 2916 8C39.tmp 31 PID 2916 wrote to memory of 2564 2916 8C39.tmp 31 PID 2916 wrote to memory of 2564 2916 8C39.tmp 31 PID 2564 wrote to memory of 3064 2564 8D13.tmp 32 PID 2564 wrote to memory of 3064 2564 8D13.tmp 32 PID 2564 wrote to memory of 3064 2564 8D13.tmp 32 PID 2564 wrote to memory of 3064 2564 8D13.tmp 32 PID 3064 wrote to memory of 2636 3064 8DFD.tmp 33 PID 3064 wrote to memory of 2636 3064 8DFD.tmp 33 PID 3064 wrote to memory of 2636 3064 8DFD.tmp 33 PID 3064 wrote to memory of 2636 3064 8DFD.tmp 33 PID 2636 wrote to memory of 2160 2636 8F06.tmp 34 PID 2636 wrote to memory of 2160 2636 8F06.tmp 34 PID 2636 wrote to memory of 2160 2636 8F06.tmp 34 PID 2636 wrote to memory of 2160 2636 8F06.tmp 34 PID 2160 wrote to memory of 2828 2160 8FD1.tmp 35 PID 2160 wrote to memory of 2828 2160 8FD1.tmp 35 PID 2160 wrote to memory of 2828 2160 8FD1.tmp 35 PID 2160 wrote to memory of 2828 2160 8FD1.tmp 35 PID 2828 wrote to memory of 2400 2828 909C.tmp 36 PID 2828 wrote to memory of 2400 2828 909C.tmp 36 PID 2828 wrote to memory of 2400 2828 909C.tmp 36 PID 2828 wrote to memory of 2400 2828 909C.tmp 36 PID 2400 wrote to memory of 2364 2400 9138.tmp 37 PID 2400 wrote to memory of 2364 2400 9138.tmp 37 PID 2400 wrote to memory of 2364 2400 9138.tmp 37 PID 2400 wrote to memory of 2364 2400 9138.tmp 37 PID 2364 wrote to memory of 2832 2364 9212.tmp 38 PID 2364 wrote to memory of 2832 2364 9212.tmp 38 PID 2364 wrote to memory of 2832 2364 9212.tmp 38 PID 2364 wrote to memory of 2832 2364 9212.tmp 38 PID 2832 wrote to memory of 2156 2832 930C.tmp 39 PID 2832 wrote to memory of 2156 2832 930C.tmp 39 PID 2832 wrote to memory of 2156 2832 930C.tmp 39 PID 2832 wrote to memory of 2156 2832 930C.tmp 39 PID 2156 wrote to memory of 856 2156 93C7.tmp 40 PID 2156 wrote to memory of 856 2156 93C7.tmp 40 PID 2156 wrote to memory of 856 2156 93C7.tmp 40 PID 2156 wrote to memory of 856 2156 93C7.tmp 40 PID 856 wrote to memory of 960 856 94A1.tmp 41 PID 856 wrote to memory of 960 856 94A1.tmp 41 PID 856 wrote to memory of 960 856 94A1.tmp 41 PID 856 wrote to memory of 960 856 94A1.tmp 41 PID 960 wrote to memory of 1760 960 956C.tmp 42 PID 960 wrote to memory of 1760 960 956C.tmp 42 PID 960 wrote to memory of 1760 960 956C.tmp 42 PID 960 wrote to memory of 1760 960 956C.tmp 42 PID 1760 wrote to memory of 2640 1760 9627.tmp 43 PID 1760 wrote to memory of 2640 1760 9627.tmp 43 PID 1760 wrote to memory of 2640 1760 9627.tmp 43 PID 1760 wrote to memory of 2640 1760 9627.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_914b9c55d125f4f516230aa71c2fe370_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\AA82.tmp"C:\Users\Admin\AppData\Local\Temp\AA82.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"55⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"56⤵
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"66⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B589.tmp"C:\Users\Admin\AppData\Local\Temp\B589.tmp"67⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"69⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"70⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"71⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"72⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"73⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"74⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"75⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"76⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"77⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"78⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"79⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"80⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"81⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"82⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"83⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"84⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"86⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"87⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"89⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"90⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"92⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"93⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"94⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"95⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"96⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"97⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"98⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"99⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"100⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"101⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"102⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"103⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"104⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"105⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"106⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"107⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"108⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"110⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"111⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"112⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"113⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"114⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"115⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"116⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"117⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"118⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"121⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-