Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 06:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe
-
Size
486KB
-
MD5
d9fdc96ff531edfd1ed45146e079b719
-
SHA1
c8b5954f8f0839674e0926101701337632fedf36
-
SHA256
ff6ba739ccf5feabc7a4c007b8ff8577f2b8d02c4aba425e57eb1f4ed37caef7
-
SHA512
c5980192f55ec43bc9b9166775ea9cdeb698d826148d12cf2a756c201b61d26b9b9ba91bdd6fe6bfcda40335f45ea895c0786ca9bbff650f9c826d22147a6507
-
SSDEEP
12288:UU5rCOTeiDtvFVVBYOotLCzWNYbK3GafUONZ:UUQOJDFFVDYOohYWWbK3/sON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2184 A554.tmp 1884 A64D.tmp 2332 A785.tmp 2824 A86F.tmp 1992 A959.tmp 2888 AA63.tmp 3000 AB9B.tmp 1964 AC56.tmp 2508 AD40.tmp 2640 AE59.tmp 2772 AF62.tmp 2940 B0B9.tmp 1148 B1D2.tmp 2868 B2DB.tmp 2376 B3C5.tmp 2444 B4BF.tmp 2852 B5A9.tmp 1216 B6C1.tmp 560 B895.tmp 1568 BA3B.tmp 1516 BB63.tmp 1644 BC9B.tmp 752 BD95.tmp 1628 BE31.tmp 1832 BECD.tmp 1340 BF59.tmp 1492 BFD6.tmp 2440 C062.tmp 2684 C10E.tmp 676 C1AA.tmp 2752 C227.tmp 2712 C2A3.tmp 2088 C320.tmp 2708 C38D.tmp 1948 C439.tmp 428 C4A6.tmp 584 C513.tmp 1224 C5AF.tmp 272 C63C.tmp 1556 C6B9.tmp 1564 C735.tmp 1484 C7A3.tmp 3012 C84E.tmp 1252 C8BB.tmp 1468 C929.tmp 904 C9B5.tmp 3068 CA41.tmp 2076 CADD.tmp 2988 CB5A.tmp 2084 CBD7.tmp 2268 CC54.tmp 2164 CCE0.tmp 876 CDE9.tmp 2100 CE85.tmp 1772 CF21.tmp 1604 CF9E.tmp 1612 D03A.tmp 2192 D0B7.tmp 2232 D172.tmp 1884 D1FF.tmp 2816 D26C.tmp 2876 D2F8.tmp 2824 D385.tmp 1744 D401.tmp -
Loads dropped DLL 64 IoCs
pid Process 1968 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 2184 A554.tmp 1884 A64D.tmp 2332 A785.tmp 2824 A86F.tmp 1992 A959.tmp 2888 AA63.tmp 3000 AB9B.tmp 1964 AC56.tmp 2508 AD40.tmp 2640 AE59.tmp 2772 AF62.tmp 2940 B0B9.tmp 1148 B1D2.tmp 2868 B2DB.tmp 2376 B3C5.tmp 2444 B4BF.tmp 2852 B5A9.tmp 1216 B6C1.tmp 560 B895.tmp 1568 BA3B.tmp 1516 BB63.tmp 1644 BC9B.tmp 752 BD95.tmp 1628 BE31.tmp 1832 BECD.tmp 1340 BF59.tmp 1492 BFD6.tmp 2440 C062.tmp 2684 C10E.tmp 676 C1AA.tmp 2752 C227.tmp 2712 C2A3.tmp 2088 C320.tmp 2708 C38D.tmp 1948 C439.tmp 428 C4A6.tmp 584 C513.tmp 1224 C5AF.tmp 272 C63C.tmp 1556 C6B9.tmp 1564 C735.tmp 1484 C7A3.tmp 3012 C84E.tmp 1252 C8BB.tmp 1468 C929.tmp 904 C9B5.tmp 3068 CA41.tmp 2076 CADD.tmp 2988 CB5A.tmp 2084 CBD7.tmp 2268 CC54.tmp 2164 CCE0.tmp 876 CDE9.tmp 2100 CE85.tmp 1772 CF21.tmp 1604 CF9E.tmp 1612 D03A.tmp 2192 D0B7.tmp 2232 D172.tmp 1884 D1FF.tmp 2816 D26C.tmp 2876 D2F8.tmp 2824 D385.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2184 1968 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 28 PID 1968 wrote to memory of 2184 1968 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 28 PID 1968 wrote to memory of 2184 1968 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 28 PID 1968 wrote to memory of 2184 1968 2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe 28 PID 2184 wrote to memory of 1884 2184 A554.tmp 29 PID 2184 wrote to memory of 1884 2184 A554.tmp 29 PID 2184 wrote to memory of 1884 2184 A554.tmp 29 PID 2184 wrote to memory of 1884 2184 A554.tmp 29 PID 1884 wrote to memory of 2332 1884 A64D.tmp 30 PID 1884 wrote to memory of 2332 1884 A64D.tmp 30 PID 1884 wrote to memory of 2332 1884 A64D.tmp 30 PID 1884 wrote to memory of 2332 1884 A64D.tmp 30 PID 2332 wrote to memory of 2824 2332 A785.tmp 31 PID 2332 wrote to memory of 2824 2332 A785.tmp 31 PID 2332 wrote to memory of 2824 2332 A785.tmp 31 PID 2332 wrote to memory of 2824 2332 A785.tmp 31 PID 2824 wrote to memory of 1992 2824 A86F.tmp 32 PID 2824 wrote to memory of 1992 2824 A86F.tmp 32 PID 2824 wrote to memory of 1992 2824 A86F.tmp 32 PID 2824 wrote to memory of 1992 2824 A86F.tmp 32 PID 1992 wrote to memory of 2888 1992 A959.tmp 33 PID 1992 wrote to memory of 2888 1992 A959.tmp 33 PID 1992 wrote to memory of 2888 1992 A959.tmp 33 PID 1992 wrote to memory of 2888 1992 A959.tmp 33 PID 2888 wrote to memory of 3000 2888 AA63.tmp 34 PID 2888 wrote to memory of 3000 2888 AA63.tmp 34 PID 2888 wrote to memory of 3000 2888 AA63.tmp 34 PID 2888 wrote to memory of 3000 2888 AA63.tmp 34 PID 3000 wrote to memory of 1964 3000 AB9B.tmp 35 PID 3000 wrote to memory of 1964 3000 AB9B.tmp 35 PID 3000 wrote to memory of 1964 3000 AB9B.tmp 35 PID 3000 wrote to memory of 1964 3000 AB9B.tmp 35 PID 1964 wrote to memory of 2508 1964 AC56.tmp 36 PID 1964 wrote to memory of 2508 1964 AC56.tmp 36 PID 1964 wrote to memory of 2508 1964 AC56.tmp 36 PID 1964 wrote to memory of 2508 1964 AC56.tmp 36 PID 2508 wrote to memory of 2640 2508 AD40.tmp 37 PID 2508 wrote to memory of 2640 2508 AD40.tmp 37 PID 2508 wrote to memory of 2640 2508 AD40.tmp 37 PID 2508 wrote to memory of 2640 2508 AD40.tmp 37 PID 2640 wrote to memory of 2772 2640 AE59.tmp 38 PID 2640 wrote to memory of 2772 2640 AE59.tmp 38 PID 2640 wrote to memory of 2772 2640 AE59.tmp 38 PID 2640 wrote to memory of 2772 2640 AE59.tmp 38 PID 2772 wrote to memory of 2940 2772 AF62.tmp 39 PID 2772 wrote to memory of 2940 2772 AF62.tmp 39 PID 2772 wrote to memory of 2940 2772 AF62.tmp 39 PID 2772 wrote to memory of 2940 2772 AF62.tmp 39 PID 2940 wrote to memory of 1148 2940 B0B9.tmp 40 PID 2940 wrote to memory of 1148 2940 B0B9.tmp 40 PID 2940 wrote to memory of 1148 2940 B0B9.tmp 40 PID 2940 wrote to memory of 1148 2940 B0B9.tmp 40 PID 1148 wrote to memory of 2868 1148 B1D2.tmp 41 PID 1148 wrote to memory of 2868 1148 B1D2.tmp 41 PID 1148 wrote to memory of 2868 1148 B1D2.tmp 41 PID 1148 wrote to memory of 2868 1148 B1D2.tmp 41 PID 2868 wrote to memory of 2376 2868 B2DB.tmp 42 PID 2868 wrote to memory of 2376 2868 B2DB.tmp 42 PID 2868 wrote to memory of 2376 2868 B2DB.tmp 42 PID 2868 wrote to memory of 2376 2868 B2DB.tmp 42 PID 2376 wrote to memory of 2444 2376 B3C5.tmp 43 PID 2376 wrote to memory of 2444 2376 B3C5.tmp 43 PID 2376 wrote to memory of 2444 2376 B3C5.tmp 43 PID 2376 wrote to memory of 2444 2376 B3C5.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_d9fdc96ff531edfd1ed45146e079b719_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Users\Admin\AppData\Local\Temp\BE31.tmp"C:\Users\Admin\AppData\Local\Temp\BE31.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"C:\Users\Admin\AppData\Local\Temp\C2A3.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:428 -
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"65⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"66⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"67⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"68⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"69⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"70⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"71⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"72⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"73⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"74⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"75⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"76⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"77⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\DA87.tmp"C:\Users\Admin\AppData\Local\Temp\DA87.tmp"78⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"79⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"80⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"81⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"82⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"83⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"84⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"C:\Users\Admin\AppData\Local\Temp\DE1F.tmp"85⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"86⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"87⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"88⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"89⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"90⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"91⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"92⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\E35D.tmp"C:\Users\Admin\AppData\Local\Temp\E35D.tmp"93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"C:\Users\Admin\AppData\Local\Temp\E3DA.tmp"94⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"95⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"96⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"97⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"98⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\E64A.tmp"C:\Users\Admin\AppData\Local\Temp\E64A.tmp"99⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"101⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"102⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"103⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"104⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"105⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"106⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"107⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"108⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"109⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"110⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"111⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"112⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"113⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"114⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"C:\Users\Admin\AppData\Local\Temp\EDE8.tmp"115⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"116⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"117⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"118⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"119⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"120⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\F122.tmp"C:\Users\Admin\AppData\Local\Temp\F122.tmp"121⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-