Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe
-
Size
712KB
-
MD5
2bc5ba4c574bf6d42a4ead2a96c2957c
-
SHA1
7b6074a6de1eeb32e4653d084ca00d19b42fcd55
-
SHA256
354111cbcb0ea8fc46c596d745aa0b99daf58f7c4a7d2df71f3c81118839aa05
-
SHA512
ae8695bf78c2c5a0c99f9207f4feefcbc4c8f600b1adcc63a7fc23448588367f6a1b00e60217b0b2166d7a30b1c32c9bd05d8940586bcd7f5447e337d991b6da
-
SSDEEP
12288:FU5rCOTeiDeDK0pgq81lHxkE1EWLXHY2nqG/eNZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDsuq8THxkCvXY2jeNnCvq5TJLC0
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3056 68E1.tmp 2952 6A09.tmp 2216 6B41.tmp 2780 6C98.tmp 2872 6DEF.tmp 2236 6F37.tmp 2932 708E.tmp 2644 71E5.tmp 1264 734C.tmp 2636 7494.tmp 2528 7629.tmp 2340 7771.tmp 2604 78A9.tmp 1524 7A1F.tmp 2576 7D4B.tmp 1960 7E92.tmp 2532 7FBB.tmp 2812 80D3.tmp 2288 823A.tmp 2988 8372.tmp 1204 84C9.tmp 2660 8601.tmp 1596 86DC.tmp 1516 8759.tmp 1664 87D5.tmp 2412 8852.tmp 2904 88CF.tmp 2252 894C.tmp 2008 89C9.tmp 2164 8A36.tmp 2072 8AD2.tmp 1428 8B4F.tmp 684 8BCB.tmp 1444 8C67.tmp 2140 8CE4.tmp 1132 8D71.tmp 672 8DED.tmp 2404 8E7A.tmp 2396 8F06.tmp 2428 8FA2.tmp 792 901F.tmp 1712 90BB.tmp 804 927F.tmp 624 93E6.tmp 1728 9453.tmp 2568 94E0.tmp 1372 955D.tmp 2108 95D9.tmp 2408 9666.tmp 856 96E3.tmp 1032 975F.tmp 1760 97DC.tmp 2172 9869.tmp 2700 98D6.tmp 2596 9962.tmp 2804 99FE.tmp 1612 9AAA.tmp 2204 9B17.tmp 2868 9BA3.tmp 3064 9C20.tmp 2940 9C9D.tmp 2928 9D29.tmp 2840 9DA6.tmp 2932 9E33.tmp -
Loads dropped DLL 64 IoCs
pid Process 2508 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 3056 68E1.tmp 2952 6A09.tmp 2216 6B41.tmp 2780 6C98.tmp 2872 6DEF.tmp 2236 6F37.tmp 2932 708E.tmp 2644 71E5.tmp 1264 734C.tmp 2636 7494.tmp 2528 7629.tmp 2340 7771.tmp 2604 78A9.tmp 1524 7A1F.tmp 2576 7D4B.tmp 1960 7E92.tmp 2532 7FBB.tmp 2812 80D3.tmp 2288 823A.tmp 2988 8372.tmp 1204 84C9.tmp 2660 8601.tmp 1596 86DC.tmp 1516 8759.tmp 1664 87D5.tmp 2412 8852.tmp 2904 88CF.tmp 2252 894C.tmp 2008 89C9.tmp 2164 8A36.tmp 2072 8AD2.tmp 1428 8B4F.tmp 684 8BCB.tmp 1444 8C67.tmp 2140 8CE4.tmp 1132 8D71.tmp 672 8DED.tmp 2404 8E7A.tmp 2396 8F06.tmp 2428 8FA2.tmp 792 901F.tmp 1712 90BB.tmp 804 927F.tmp 624 93E6.tmp 1728 9453.tmp 2568 94E0.tmp 1372 955D.tmp 2108 95D9.tmp 2408 9666.tmp 856 96E3.tmp 1032 975F.tmp 1760 97DC.tmp 2172 9869.tmp 2700 98D6.tmp 2596 9962.tmp 2804 99FE.tmp 1612 9AAA.tmp 2204 9B17.tmp 2868 9BA3.tmp 3064 9C20.tmp 2940 9C9D.tmp 2928 9D29.tmp 2840 9DA6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 3056 2508 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 29 PID 2508 wrote to memory of 3056 2508 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 29 PID 2508 wrote to memory of 3056 2508 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 29 PID 2508 wrote to memory of 3056 2508 2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe 29 PID 3056 wrote to memory of 2952 3056 68E1.tmp 30 PID 3056 wrote to memory of 2952 3056 68E1.tmp 30 PID 3056 wrote to memory of 2952 3056 68E1.tmp 30 PID 3056 wrote to memory of 2952 3056 68E1.tmp 30 PID 2952 wrote to memory of 2216 2952 6A09.tmp 31 PID 2952 wrote to memory of 2216 2952 6A09.tmp 31 PID 2952 wrote to memory of 2216 2952 6A09.tmp 31 PID 2952 wrote to memory of 2216 2952 6A09.tmp 31 PID 2216 wrote to memory of 2780 2216 6B41.tmp 32 PID 2216 wrote to memory of 2780 2216 6B41.tmp 32 PID 2216 wrote to memory of 2780 2216 6B41.tmp 32 PID 2216 wrote to memory of 2780 2216 6B41.tmp 32 PID 2780 wrote to memory of 2872 2780 6C98.tmp 33 PID 2780 wrote to memory of 2872 2780 6C98.tmp 33 PID 2780 wrote to memory of 2872 2780 6C98.tmp 33 PID 2780 wrote to memory of 2872 2780 6C98.tmp 33 PID 2872 wrote to memory of 2236 2872 6DEF.tmp 34 PID 2872 wrote to memory of 2236 2872 6DEF.tmp 34 PID 2872 wrote to memory of 2236 2872 6DEF.tmp 34 PID 2872 wrote to memory of 2236 2872 6DEF.tmp 34 PID 2236 wrote to memory of 2932 2236 6F37.tmp 35 PID 2236 wrote to memory of 2932 2236 6F37.tmp 35 PID 2236 wrote to memory of 2932 2236 6F37.tmp 35 PID 2236 wrote to memory of 2932 2236 6F37.tmp 35 PID 2932 wrote to memory of 2644 2932 708E.tmp 36 PID 2932 wrote to memory of 2644 2932 708E.tmp 36 PID 2932 wrote to memory of 2644 2932 708E.tmp 36 PID 2932 wrote to memory of 2644 2932 708E.tmp 36 PID 2644 wrote to memory of 1264 2644 71E5.tmp 37 PID 2644 wrote to memory of 1264 2644 71E5.tmp 37 PID 2644 wrote to memory of 1264 2644 71E5.tmp 37 PID 2644 wrote to memory of 1264 2644 71E5.tmp 37 PID 1264 wrote to memory of 2636 1264 734C.tmp 38 PID 1264 wrote to memory of 2636 1264 734C.tmp 38 PID 1264 wrote to memory of 2636 1264 734C.tmp 38 PID 1264 wrote to memory of 2636 1264 734C.tmp 38 PID 2636 wrote to memory of 2528 2636 7494.tmp 39 PID 2636 wrote to memory of 2528 2636 7494.tmp 39 PID 2636 wrote to memory of 2528 2636 7494.tmp 39 PID 2636 wrote to memory of 2528 2636 7494.tmp 39 PID 2528 wrote to memory of 2340 2528 7629.tmp 40 PID 2528 wrote to memory of 2340 2528 7629.tmp 40 PID 2528 wrote to memory of 2340 2528 7629.tmp 40 PID 2528 wrote to memory of 2340 2528 7629.tmp 40 PID 2340 wrote to memory of 2604 2340 7771.tmp 41 PID 2340 wrote to memory of 2604 2340 7771.tmp 41 PID 2340 wrote to memory of 2604 2340 7771.tmp 41 PID 2340 wrote to memory of 2604 2340 7771.tmp 41 PID 2604 wrote to memory of 1524 2604 78A9.tmp 42 PID 2604 wrote to memory of 1524 2604 78A9.tmp 42 PID 2604 wrote to memory of 1524 2604 78A9.tmp 42 PID 2604 wrote to memory of 1524 2604 78A9.tmp 42 PID 1524 wrote to memory of 2576 1524 7A1F.tmp 43 PID 1524 wrote to memory of 2576 1524 7A1F.tmp 43 PID 1524 wrote to memory of 2576 1524 7A1F.tmp 43 PID 1524 wrote to memory of 2576 1524 7A1F.tmp 43 PID 2576 wrote to memory of 1960 2576 7D4B.tmp 44 PID 2576 wrote to memory of 1960 2576 7D4B.tmp 44 PID 2576 wrote to memory of 1960 2576 7D4B.tmp 44 PID 2576 wrote to memory of 1960 2576 7D4B.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_2bc5ba4c574bf6d42a4ead2a96c2957c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6B41.tmp"C:\Users\Admin\AppData\Local\Temp\6B41.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"C:\Users\Admin\AppData\Local\Temp\6DEF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\78A9.tmp"C:\Users\Admin\AppData\Local\Temp\78A9.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\823A.tmp"C:\Users\Admin\AppData\Local\Temp\823A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8852.tmp"C:\Users\Admin\AppData\Local\Temp\8852.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\88CF.tmp"C:\Users\Admin\AppData\Local\Temp\88CF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:792 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\9453.tmp"C:\Users\Admin\AppData\Local\Temp\9453.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"65⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"66⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"67⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"68⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"69⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"70⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"71⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"72⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"73⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"74⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"75⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"76⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"77⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"78⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"80⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"81⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"82⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"83⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"84⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"85⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"86⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"C:\Users\Admin\AppData\Local\Temp\AAC0.tmp"87⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"88⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"89⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"91⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"92⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"93⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"94⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"95⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B01D.tmp"C:\Users\Admin\AppData\Local\Temp\B01D.tmp"97⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"98⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"99⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"100⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"101⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"102⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"104⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"105⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"106⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"107⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"108⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"109⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"110⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"111⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"112⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"113⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"114⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"115⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"116⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"117⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"118⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"119⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"120⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"121⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-