Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
-
Size
488KB
-
MD5
caef0543ee65cfe04f95e811349642ef
-
SHA1
c0eed32e2366c47f5a12285e27d47fc4f42bccc4
-
SHA256
c8b0ec57205dd82381be9612ad44cea4848f4b0de08dd443171332823bed8083
-
SHA512
f09075932831341d3f5ca3397512a48015c1c0356ed528f7faa950a4c3eaed5296b906c2f7ff246f26c40af0cfa5bd1ed1c57cbd4fe83473fb3412dd03abe34e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7gWPwNuy0uuehDWzUtv5T0MeCCzKudM6BXRPG:/U5rCOTeiDGAluTSKd0bRKyrVBEtNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2248 AEC6.tmp 2848 AF14.tmp 2964 AF62.tmp 2316 AFEE.tmp 2456 B03C.tmp 1208 B0B9.tmp 1700 B126.tmp 304 B1A3.tmp 1672 B24F.tmp 2624 B2CB.tmp 2728 B30A.tmp 2844 B3D5.tmp 2600 B461.tmp 2792 B4DE.tmp 2532 B56A.tmp 2480 B5D7.tmp 2408 B664.tmp 2056 B6E1.tmp 1292 B76D.tmp 2228 B7EA.tmp 1920 B857.tmp 1936 B8A5.tmp 1992 B8E3.tmp 2420 B931.tmp 1752 B970.tmp 2396 B9AE.tmp 1760 B9FC.tmp 1628 BA3B.tmp 1968 BA79.tmp 1972 BAB7.tmp 1484 BAF6.tmp 1056 BB34.tmp 2724 BB73.tmp 700 BBC1.tmp 2788 BBFF.tmp 440 BC3D.tmp 2812 BC7C.tmp 2672 BCBA.tmp 1480 BCF9.tmp 1600 BD37.tmp 904 BD75.tmp 1352 BDB4.tmp 2188 BDF2.tmp 1436 BE31.tmp 876 BE7F.tmp 944 BEBD.tmp 2384 BEFB.tmp 2868 BF3A.tmp 1636 BF88.tmp 2860 BFD6.tmp 2224 C024.tmp 2804 C062.tmp 2324 C0B0.tmp 1596 C0FE.tmp 292 C14C.tmp 1588 C1B9.tmp 2300 C1F8.tmp 2248 C236.tmp 2904 C284.tmp 2952 C2D2.tmp 2436 C311.tmp 2960 C34F.tmp 2096 C39D.tmp 2768 C3DB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2160 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 2248 AEC6.tmp 2848 AF14.tmp 2964 AF62.tmp 2316 AFEE.tmp 2456 B03C.tmp 1208 B0B9.tmp 1700 B126.tmp 304 B1A3.tmp 1672 B24F.tmp 2624 B2CB.tmp 2728 B30A.tmp 2844 B3D5.tmp 2600 B461.tmp 2792 B4DE.tmp 2532 B56A.tmp 2480 B5D7.tmp 2408 B664.tmp 2056 B6E1.tmp 1292 B76D.tmp 2228 B7EA.tmp 1920 B857.tmp 1936 B8A5.tmp 1992 B8E3.tmp 2420 B931.tmp 1752 B970.tmp 2396 B9AE.tmp 1760 B9FC.tmp 1628 BA3B.tmp 1968 BA79.tmp 1972 BAB7.tmp 1484 BAF6.tmp 1056 BB34.tmp 2724 BB73.tmp 700 BBC1.tmp 2788 BBFF.tmp 440 BC3D.tmp 2812 BC7C.tmp 2672 BCBA.tmp 1480 BCF9.tmp 1600 BD37.tmp 904 BD75.tmp 1352 BDB4.tmp 2188 BDF2.tmp 1436 BE31.tmp 876 BE7F.tmp 944 BEBD.tmp 2384 BEFB.tmp 2868 BF3A.tmp 1636 BF88.tmp 2860 BFD6.tmp 2224 C024.tmp 2804 C062.tmp 2324 C0B0.tmp 1596 C0FE.tmp 292 C14C.tmp 1588 C1B9.tmp 2300 C1F8.tmp 2248 C236.tmp 2904 C284.tmp 2952 C2D2.tmp 2436 C311.tmp 2960 C34F.tmp 2096 C39D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2248 2160 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 28 PID 2160 wrote to memory of 2248 2160 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 28 PID 2160 wrote to memory of 2248 2160 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 28 PID 2160 wrote to memory of 2248 2160 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 28 PID 2248 wrote to memory of 2848 2248 AEC6.tmp 29 PID 2248 wrote to memory of 2848 2248 AEC6.tmp 29 PID 2248 wrote to memory of 2848 2248 AEC6.tmp 29 PID 2248 wrote to memory of 2848 2248 AEC6.tmp 29 PID 2848 wrote to memory of 2964 2848 AF14.tmp 30 PID 2848 wrote to memory of 2964 2848 AF14.tmp 30 PID 2848 wrote to memory of 2964 2848 AF14.tmp 30 PID 2848 wrote to memory of 2964 2848 AF14.tmp 30 PID 2964 wrote to memory of 2316 2964 AF62.tmp 31 PID 2964 wrote to memory of 2316 2964 AF62.tmp 31 PID 2964 wrote to memory of 2316 2964 AF62.tmp 31 PID 2964 wrote to memory of 2316 2964 AF62.tmp 31 PID 2316 wrote to memory of 2456 2316 AFEE.tmp 32 PID 2316 wrote to memory of 2456 2316 AFEE.tmp 32 PID 2316 wrote to memory of 2456 2316 AFEE.tmp 32 PID 2316 wrote to memory of 2456 2316 AFEE.tmp 32 PID 2456 wrote to memory of 1208 2456 B03C.tmp 33 PID 2456 wrote to memory of 1208 2456 B03C.tmp 33 PID 2456 wrote to memory of 1208 2456 B03C.tmp 33 PID 2456 wrote to memory of 1208 2456 B03C.tmp 33 PID 1208 wrote to memory of 1700 1208 B0B9.tmp 34 PID 1208 wrote to memory of 1700 1208 B0B9.tmp 34 PID 1208 wrote to memory of 1700 1208 B0B9.tmp 34 PID 1208 wrote to memory of 1700 1208 B0B9.tmp 34 PID 1700 wrote to memory of 304 1700 B126.tmp 35 PID 1700 wrote to memory of 304 1700 B126.tmp 35 PID 1700 wrote to memory of 304 1700 B126.tmp 35 PID 1700 wrote to memory of 304 1700 B126.tmp 35 PID 304 wrote to memory of 1672 304 B1A3.tmp 36 PID 304 wrote to memory of 1672 304 B1A3.tmp 36 PID 304 wrote to memory of 1672 304 B1A3.tmp 36 PID 304 wrote to memory of 1672 304 B1A3.tmp 36 PID 1672 wrote to memory of 2624 1672 B24F.tmp 37 PID 1672 wrote to memory of 2624 1672 B24F.tmp 37 PID 1672 wrote to memory of 2624 1672 B24F.tmp 37 PID 1672 wrote to memory of 2624 1672 B24F.tmp 37 PID 2624 wrote to memory of 2728 2624 B2CB.tmp 38 PID 2624 wrote to memory of 2728 2624 B2CB.tmp 38 PID 2624 wrote to memory of 2728 2624 B2CB.tmp 38 PID 2624 wrote to memory of 2728 2624 B2CB.tmp 38 PID 2728 wrote to memory of 2844 2728 B30A.tmp 39 PID 2728 wrote to memory of 2844 2728 B30A.tmp 39 PID 2728 wrote to memory of 2844 2728 B30A.tmp 39 PID 2728 wrote to memory of 2844 2728 B30A.tmp 39 PID 2844 wrote to memory of 2600 2844 B3D5.tmp 40 PID 2844 wrote to memory of 2600 2844 B3D5.tmp 40 PID 2844 wrote to memory of 2600 2844 B3D5.tmp 40 PID 2844 wrote to memory of 2600 2844 B3D5.tmp 40 PID 2600 wrote to memory of 2792 2600 B461.tmp 41 PID 2600 wrote to memory of 2792 2600 B461.tmp 41 PID 2600 wrote to memory of 2792 2600 B461.tmp 41 PID 2600 wrote to memory of 2792 2600 B461.tmp 41 PID 2792 wrote to memory of 2532 2792 B4DE.tmp 42 PID 2792 wrote to memory of 2532 2792 B4DE.tmp 42 PID 2792 wrote to memory of 2532 2792 B4DE.tmp 42 PID 2792 wrote to memory of 2532 2792 B4DE.tmp 42 PID 2532 wrote to memory of 2480 2532 B56A.tmp 43 PID 2532 wrote to memory of 2480 2532 B56A.tmp 43 PID 2532 wrote to memory of 2480 2532 B56A.tmp 43 PID 2532 wrote to memory of 2480 2532 B56A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\B970.tmp"C:\Users\Admin\AppData\Local\Temp\B970.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\BD75.tmp"C:\Users\Admin\AppData\Local\Temp\BD75.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"C:\Users\Admin\AppData\Local\Temp\BDF2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"65⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\C41A.tmp"C:\Users\Admin\AppData\Local\Temp\C41A.tmp"66⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C458.tmp"C:\Users\Admin\AppData\Local\Temp\C458.tmp"67⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C497.tmp"C:\Users\Admin\AppData\Local\Temp\C497.tmp"68⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"69⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\C561.tmp"C:\Users\Admin\AppData\Local\Temp\C561.tmp"71⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"72⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"73⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"74⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"75⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"76⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"77⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"78⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"79⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"80⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"81⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"82⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"83⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"84⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"85⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"86⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"87⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"88⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"89⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"90⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"91⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"92⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"93⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"94⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"95⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"96⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"97⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"99⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"100⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"101⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"102⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"103⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"104⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"106⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"107⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"108⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"109⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"110⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"111⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"112⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"113⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"114⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"115⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"116⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"117⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"118⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"119⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"120⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\D317.tmp"C:\Users\Admin\AppData\Local\Temp\D317.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"122⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-