Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe
-
Size
488KB
-
MD5
c519862d29d991c54de6b9bf5e8d49dd
-
SHA1
9f82b547d3ebe5827b4963ff9d0188b461336516
-
SHA256
e92f0565e3df6d51cafa548b53622b256613eb211e739a5c61370f45fd7a6afb
-
SHA512
9d766d0cc86673be30cf9b19374864b6175a068dc32d9535335d0bdf5ab108d8900e277f5a7464baca832fba0d0c786e7f6b3359806b8f5bbbaec0b952e78a88
-
SSDEEP
12288:/U5rCOTeiD5uqp6ugQ8AdTpSl6bYEEMNZ:/UQOJD5npb4AdJbFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2808 9B55.tmp 2852 9C30.tmp 3048 9D0A.tmp 2980 9DB6.tmp 2872 9E52.tmp 2572 9F3C.tmp 2508 9FC8.tmp 2608 A093.tmp 2660 A15E.tmp 2496 A1DB.tmp 1252 A296.tmp 2420 A313.tmp 2408 A3BE.tmp 2344 A45A.tmp 1884 A525.tmp 928 A5B1.tmp 2592 A67C.tmp 2820 A718.tmp 1724 A7B4.tmp 628 A841.tmp 1036 A8EC.tmp 1328 A998.tmp 1736 AA15.tmp 1728 AAB1.tmp 1400 AB2D.tmp 1624 AB8B.tmp 1576 ABF8.tmp 1544 AD30.tmp 336 ADAD.tmp 580 AE1A.tmp 1016 AE87.tmp 860 AF14.tmp 576 AF81.tmp 2144 AFFE.tmp 1092 B06B.tmp 440 B0E8.tmp 3004 B165.tmp 2032 B1D2.tmp 1088 B24F.tmp 1676 B2CB.tmp 1620 B367.tmp 1204 B3E4.tmp 2932 B451.tmp 1924 B4BF.tmp 652 B50D.tmp 2828 B57A.tmp 1056 B5F7.tmp 2324 B654.tmp 776 B6C1.tmp 708 B73E.tmp 2308 B7AB.tmp 1508 B809.tmp 1660 B876.tmp 2740 B8E3.tmp 1612 B951.tmp 1572 B9BE.tmp 2636 BA3B.tmp 2240 BAA8.tmp 3064 BB05.tmp 2848 BB73.tmp 2688 BBFF.tmp 2912 BC5D.tmp 2588 BCD9.tmp 2468 BD37.tmp -
Loads dropped DLL 64 IoCs
pid Process 2752 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 2808 9B55.tmp 2852 9C30.tmp 3048 9D0A.tmp 2980 9DB6.tmp 2872 9E52.tmp 2572 9F3C.tmp 2508 9FC8.tmp 2608 A093.tmp 2660 A15E.tmp 2496 A1DB.tmp 1252 A296.tmp 2420 A313.tmp 2408 A3BE.tmp 2344 A45A.tmp 1884 A525.tmp 928 A5B1.tmp 2592 A67C.tmp 2820 A718.tmp 1724 A7B4.tmp 628 A841.tmp 1036 A8EC.tmp 1328 A998.tmp 1736 AA15.tmp 1728 AAB1.tmp 1400 AB2D.tmp 1624 AB8B.tmp 1576 ABF8.tmp 1544 AD30.tmp 336 ADAD.tmp 580 AE1A.tmp 1016 AE87.tmp 860 AF14.tmp 576 AF81.tmp 2144 AFFE.tmp 1092 B06B.tmp 440 B0E8.tmp 3004 B165.tmp 2032 B1D2.tmp 1088 B24F.tmp 1676 B2CB.tmp 1620 B367.tmp 1204 B3E4.tmp 2932 B451.tmp 1924 B4BF.tmp 652 B50D.tmp 2828 B57A.tmp 1056 B5F7.tmp 2324 B654.tmp 776 B6C1.tmp 708 B73E.tmp 2308 B7AB.tmp 1508 B809.tmp 1660 B876.tmp 2740 B8E3.tmp 1612 B951.tmp 1572 B9BE.tmp 2636 BA3B.tmp 2240 BAA8.tmp 3064 BB05.tmp 2848 BB73.tmp 2688 BBFF.tmp 2912 BC5D.tmp 2588 BCD9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2808 2752 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 28 PID 2752 wrote to memory of 2808 2752 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 28 PID 2752 wrote to memory of 2808 2752 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 28 PID 2752 wrote to memory of 2808 2752 2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe 28 PID 2808 wrote to memory of 2852 2808 9B55.tmp 29 PID 2808 wrote to memory of 2852 2808 9B55.tmp 29 PID 2808 wrote to memory of 2852 2808 9B55.tmp 29 PID 2808 wrote to memory of 2852 2808 9B55.tmp 29 PID 2852 wrote to memory of 3048 2852 9C30.tmp 30 PID 2852 wrote to memory of 3048 2852 9C30.tmp 30 PID 2852 wrote to memory of 3048 2852 9C30.tmp 30 PID 2852 wrote to memory of 3048 2852 9C30.tmp 30 PID 3048 wrote to memory of 2980 3048 9D0A.tmp 31 PID 3048 wrote to memory of 2980 3048 9D0A.tmp 31 PID 3048 wrote to memory of 2980 3048 9D0A.tmp 31 PID 3048 wrote to memory of 2980 3048 9D0A.tmp 31 PID 2980 wrote to memory of 2872 2980 9DB6.tmp 32 PID 2980 wrote to memory of 2872 2980 9DB6.tmp 32 PID 2980 wrote to memory of 2872 2980 9DB6.tmp 32 PID 2980 wrote to memory of 2872 2980 9DB6.tmp 32 PID 2872 wrote to memory of 2572 2872 9E52.tmp 33 PID 2872 wrote to memory of 2572 2872 9E52.tmp 33 PID 2872 wrote to memory of 2572 2872 9E52.tmp 33 PID 2872 wrote to memory of 2572 2872 9E52.tmp 33 PID 2572 wrote to memory of 2508 2572 9F3C.tmp 160 PID 2572 wrote to memory of 2508 2572 9F3C.tmp 160 PID 2572 wrote to memory of 2508 2572 9F3C.tmp 160 PID 2572 wrote to memory of 2508 2572 9F3C.tmp 160 PID 2508 wrote to memory of 2608 2508 9FC8.tmp 162 PID 2508 wrote to memory of 2608 2508 9FC8.tmp 162 PID 2508 wrote to memory of 2608 2508 9FC8.tmp 162 PID 2508 wrote to memory of 2608 2508 9FC8.tmp 162 PID 2608 wrote to memory of 2660 2608 A093.tmp 374 PID 2608 wrote to memory of 2660 2608 A093.tmp 374 PID 2608 wrote to memory of 2660 2608 A093.tmp 374 PID 2608 wrote to memory of 2660 2608 A093.tmp 374 PID 2660 wrote to memory of 2496 2660 A15E.tmp 37 PID 2660 wrote to memory of 2496 2660 A15E.tmp 37 PID 2660 wrote to memory of 2496 2660 A15E.tmp 37 PID 2660 wrote to memory of 2496 2660 A15E.tmp 37 PID 2496 wrote to memory of 1252 2496 A1DB.tmp 231 PID 2496 wrote to memory of 1252 2496 A1DB.tmp 231 PID 2496 wrote to memory of 1252 2496 A1DB.tmp 231 PID 2496 wrote to memory of 1252 2496 A1DB.tmp 231 PID 1252 wrote to memory of 2420 1252 A296.tmp 39 PID 1252 wrote to memory of 2420 1252 A296.tmp 39 PID 1252 wrote to memory of 2420 1252 A296.tmp 39 PID 1252 wrote to memory of 2420 1252 A296.tmp 39 PID 2420 wrote to memory of 2408 2420 A313.tmp 366 PID 2420 wrote to memory of 2408 2420 A313.tmp 366 PID 2420 wrote to memory of 2408 2420 A313.tmp 366 PID 2420 wrote to memory of 2408 2420 A313.tmp 366 PID 2408 wrote to memory of 2344 2408 A3BE.tmp 365 PID 2408 wrote to memory of 2344 2408 A3BE.tmp 365 PID 2408 wrote to memory of 2344 2408 A3BE.tmp 365 PID 2408 wrote to memory of 2344 2408 A3BE.tmp 365 PID 2344 wrote to memory of 1884 2344 A45A.tmp 42 PID 2344 wrote to memory of 1884 2344 A45A.tmp 42 PID 2344 wrote to memory of 1884 2344 A45A.tmp 42 PID 2344 wrote to memory of 1884 2344 A45A.tmp 42 PID 1884 wrote to memory of 928 1884 A525.tmp 431 PID 1884 wrote to memory of 928 1884 A525.tmp 431 PID 1884 wrote to memory of 928 1884 A525.tmp 431 PID 1884 wrote to memory of 928 1884 A525.tmp 431
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_c519862d29d991c54de6b9bf5e8d49dd_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:652 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"65⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"66⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"67⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"68⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"69⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"70⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"73⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"74⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"76⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"78⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"79⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"80⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"81⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"82⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"83⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"84⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"85⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"86⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"87⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"88⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"89⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"90⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"91⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"92⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"93⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"94⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"96⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"97⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CB99.tmp"C:\Users\Admin\AppData\Local\Temp\CB99.tmp"98⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"99⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"100⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"101⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"102⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"103⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"104⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"105⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"106⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"107⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"108⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"109⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"110⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"111⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"112⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"113⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"114⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"115⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"116⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"118⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"119⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"121⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"122⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-