Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/04/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe
-
Size
530KB
-
MD5
b24898215dab5cf7e0a756a3345cef74
-
SHA1
fb38bf65943c779384b1781692adcfdf21eca66e
-
SHA256
50c25b9bf26ca85ae0c9e21b733322eb2965a4e6508b070fa3532b77b1f1ce4e
-
SHA512
05537431373c995fbb0c2facb6aa1b9ce66bd4835fa95e47f5681a22ca217262f8a9e736c745932322ddf83a828be07f290dca47c941b52f75325bbf4647dcfc
-
SSDEEP
12288:AU5rCOTeio8uhymX8LnUOlpX48lfKJipOdDokNZulFVg0M1:AUQOJo8MymX8jLX48YopmDZNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2820 9666.tmp 2892 9721.tmp 2612 9849.tmp 2960 9933.tmp 2636 9A3D.tmp 2640 9B27.tmp 2548 9C01.tmp 2724 9D1A.tmp 2752 9E13.tmp 2472 9F0D.tmp 2456 9FF7.tmp 2864 A0E1.tmp 2200 A1AC.tmp 2408 A296.tmp 1916 A380.tmp 2708 A3FD.tmp 2764 A4F6.tmp 3064 A5F0.tmp 1140 A6DA.tmp 1964 A7F3.tmp 1540 AA53.tmp 1940 AB5C.tmp 1992 AC37.tmp 2364 ACE2.tmp 2356 AD5F.tmp 1924 ADEB.tmp 1776 AE68.tmp 1716 AEE5.tmp 2268 AF71.tmp 2064 AFFE.tmp 268 B06B.tmp 580 B0F7.tmp 668 B155.tmp 1748 B1C2.tmp 2956 B23F.tmp 2948 B2AC.tmp 672 B339.tmp 1544 B3A6.tmp 1308 B413.tmp 604 B4AF.tmp 956 B54B.tmp 340 B5C8.tmp 1492 B635.tmp 1392 B693.tmp 904 B700.tmp 2168 B78C.tmp 2152 B7F9.tmp 1340 B867.tmp 1744 B8E3.tmp 2068 B960.tmp 752 B9CD.tmp 2228 BA4A.tmp 1768 BAB7.tmp 1612 BB05.tmp 1616 BB82.tmp 2840 BBEF.tmp 2820 BC5D.tmp 2900 BCD9.tmp 2940 BD56.tmp 3028 BEFB.tmp 2780 C005.tmp 2572 C062.tmp 2716 C0CF.tmp 2668 C12D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2224 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 2820 9666.tmp 2892 9721.tmp 2612 9849.tmp 2960 9933.tmp 2636 9A3D.tmp 2640 9B27.tmp 2548 9C01.tmp 2724 9D1A.tmp 2752 9E13.tmp 2472 9F0D.tmp 2456 9FF7.tmp 2864 A0E1.tmp 2200 A1AC.tmp 2408 A296.tmp 1916 A380.tmp 2708 A3FD.tmp 2764 A4F6.tmp 3064 A5F0.tmp 1140 A6DA.tmp 1964 A7F3.tmp 1540 AA53.tmp 1940 AB5C.tmp 1992 AC37.tmp 2364 ACE2.tmp 2356 AD5F.tmp 1924 ADEB.tmp 1776 AE68.tmp 1716 AEE5.tmp 2268 AF71.tmp 2064 AFFE.tmp 268 B06B.tmp 580 B0F7.tmp 668 B155.tmp 1748 B1C2.tmp 2956 B23F.tmp 2948 B2AC.tmp 672 B339.tmp 1544 B3A6.tmp 1308 B413.tmp 604 B4AF.tmp 956 B54B.tmp 340 B5C8.tmp 1492 B635.tmp 1392 B693.tmp 904 B700.tmp 2168 B78C.tmp 2152 B7F9.tmp 1340 B867.tmp 1744 B8E3.tmp 2068 B960.tmp 752 B9CD.tmp 2228 BA4A.tmp 1768 BAB7.tmp 1612 BB05.tmp 1616 BB82.tmp 2840 BBEF.tmp 2820 BC5D.tmp 2900 BCD9.tmp 2940 BD56.tmp 3028 BEFB.tmp 2780 C005.tmp 2572 C062.tmp 2716 C0CF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2820 2224 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 28 PID 2224 wrote to memory of 2820 2224 2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe 28 PID 2820 wrote to memory of 2892 2820 9666.tmp 29 PID 2820 wrote to memory of 2892 2820 9666.tmp 29 PID 2820 wrote to memory of 2892 2820 9666.tmp 29 PID 2820 wrote to memory of 2892 2820 9666.tmp 29 PID 2892 wrote to memory of 2612 2892 9721.tmp 30 PID 2892 wrote to memory of 2612 2892 9721.tmp 30 PID 2892 wrote to memory of 2612 2892 9721.tmp 30 PID 2892 wrote to memory of 2612 2892 9721.tmp 30 PID 2612 wrote to memory of 2960 2612 9849.tmp 31 PID 2612 wrote to memory of 2960 2612 9849.tmp 31 PID 2612 wrote to memory of 2960 2612 9849.tmp 31 PID 2612 wrote to memory of 2960 2612 9849.tmp 31 PID 2960 wrote to memory of 2636 2960 9933.tmp 32 PID 2960 wrote to memory of 2636 2960 9933.tmp 32 PID 2960 wrote to memory of 2636 2960 9933.tmp 32 PID 2960 wrote to memory of 2636 2960 9933.tmp 32 PID 2636 wrote to memory of 2640 2636 9A3D.tmp 33 PID 2636 wrote to memory of 2640 2636 9A3D.tmp 33 PID 2636 wrote to memory of 2640 2636 9A3D.tmp 33 PID 2636 wrote to memory of 2640 2636 9A3D.tmp 33 PID 2640 wrote to memory of 2548 2640 9B27.tmp 34 PID 2640 wrote to memory of 2548 2640 9B27.tmp 34 PID 2640 wrote to memory of 2548 2640 9B27.tmp 34 PID 2640 wrote to memory of 2548 2640 9B27.tmp 34 PID 2548 wrote to memory of 2724 2548 9C01.tmp 35 PID 2548 wrote to memory of 2724 2548 9C01.tmp 35 PID 2548 wrote to memory of 2724 2548 9C01.tmp 35 PID 2548 wrote to memory of 2724 2548 9C01.tmp 35 PID 2724 wrote to memory of 2752 2724 9D1A.tmp 36 PID 2724 wrote to memory of 2752 2724 9D1A.tmp 36 PID 2724 wrote to memory of 2752 2724 9D1A.tmp 36 PID 2724 wrote to memory of 2752 2724 9D1A.tmp 36 PID 2752 wrote to memory of 2472 2752 9E13.tmp 37 PID 2752 wrote to memory of 2472 2752 9E13.tmp 37 PID 2752 wrote to memory of 2472 2752 9E13.tmp 37 PID 2752 wrote to memory of 2472 2752 9E13.tmp 37 PID 2472 wrote to memory of 2456 2472 9F0D.tmp 38 PID 2472 wrote to memory of 2456 2472 9F0D.tmp 38 PID 2472 wrote to memory of 2456 2472 9F0D.tmp 38 PID 2472 wrote to memory of 2456 2472 9F0D.tmp 38 PID 2456 wrote to memory of 2864 2456 9FF7.tmp 39 PID 2456 wrote to memory of 2864 2456 9FF7.tmp 39 PID 2456 wrote to memory of 2864 2456 9FF7.tmp 39 PID 2456 wrote to memory of 2864 2456 9FF7.tmp 39 PID 2864 wrote to memory of 2200 2864 A0E1.tmp 40 PID 2864 wrote to memory of 2200 2864 A0E1.tmp 40 PID 2864 wrote to memory of 2200 2864 A0E1.tmp 40 PID 2864 wrote to memory of 2200 2864 A0E1.tmp 40 PID 2200 wrote to memory of 2408 2200 A1AC.tmp 41 PID 2200 wrote to memory of 2408 2200 A1AC.tmp 41 PID 2200 wrote to memory of 2408 2200 A1AC.tmp 41 PID 2200 wrote to memory of 2408 2200 A1AC.tmp 41 PID 2408 wrote to memory of 1916 2408 A296.tmp 42 PID 2408 wrote to memory of 1916 2408 A296.tmp 42 PID 2408 wrote to memory of 1916 2408 A296.tmp 42 PID 2408 wrote to memory of 1916 2408 A296.tmp 42 PID 1916 wrote to memory of 2708 1916 A380.tmp 43 PID 1916 wrote to memory of 2708 1916 A380.tmp 43 PID 1916 wrote to memory of 2708 1916 A380.tmp 43 PID 1916 wrote to memory of 2708 1916 A380.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_b24898215dab5cf7e0a756a3345cef74_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\9E13.tmp"C:\Users\Admin\AppData\Local\Temp\9E13.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"65⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"66⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"67⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"68⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"70⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"72⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"73⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"74⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"75⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"76⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"77⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"78⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"79⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\C88D.tmp"C:\Users\Admin\AppData\Local\Temp\C88D.tmp"80⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"81⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"82⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"83⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"84⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"85⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"86⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"87⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"88⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"89⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"91⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"92⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"93⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"94⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"95⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"96⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"97⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"98⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"99⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"100⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"C:\Users\Admin\AppData\Local\Temp\D1D0.tmp"101⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\D22D.tmp"C:\Users\Admin\AppData\Local\Temp\D22D.tmp"102⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"103⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"104⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"105⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"106⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"107⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"108⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"109⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"110⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"111⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"112⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"113⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"114⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"115⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"116⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"C:\Users\Admin\AppData\Local\Temp\D9AC.tmp"117⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"118⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"119⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"120⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"121⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"122⤵PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-