Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/04/2024, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe
-
Size
488KB
-
MD5
cc991ae509fb05f7bb7984cb8e1c1e41
-
SHA1
20725be2ad6f2c27126b341b286622773299f418
-
SHA256
b00810a8f148047041835b9303e99450c8cdffaae253d9c713399ed6b03b75b4
-
SHA512
ef08fbb299091b343c5abd27a760e9bb9cc2da24974bd25047164e04708fbf28dd53263a101b595d843a6d6aba7f09c8eaf60adaefecfcd897a03354eae9041e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7iwQhNT32G60vjZMmiOKxxvDGhT0OSZBw43gj:/U5rCOTeiDiXR56qKXOOxrCHPBNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2212 1999.tmp 2512 19E7.tmp 2596 1A54.tmp 2828 1AA2.tmp 3032 1B0F.tmp 2232 1B5D.tmp 2968 1BBB.tmp 2628 1C28.tmp 2432 1CA5.tmp 2572 1D12.tmp 2960 1D7F.tmp 2664 1DCD.tmp 2732 1E2B.tmp 2764 1E88.tmp 2884 1EF6.tmp 1872 1F53.tmp 860 1FC0.tmp 288 202E.tmp 1644 20AA.tmp 2656 2108.tmp 1208 2175.tmp 2036 21F2.tmp 1940 2250.tmp 2920 228E.tmp 1904 22DC.tmp 2288 231A.tmp 2672 2359.tmp 2044 23A7.tmp 596 23E5.tmp 488 2433.tmp 576 2472.tmp 1420 24C0.tmp 1808 250E.tmp 1720 255C.tmp 2356 259A.tmp 1020 25D8.tmp 2144 2617.tmp 2784 2665.tmp 2176 26A3.tmp 716 26E2.tmp 1500 2720.tmp 976 275E.tmp 764 27AC.tmp 2848 27FA.tmp 924 2839.tmp 1224 2877.tmp 2172 28B6.tmp 1968 2904.tmp 1468 2942.tmp 1916 2980.tmp 1652 29CE.tmp 2368 2A0D.tmp 1448 2A4B.tmp 1892 2A8A.tmp 2728 2AD8.tmp 1520 2B16.tmp 3004 2B54.tmp 2936 2BA2.tmp 2508 2BF0.tmp 2532 2C2F.tmp 2700 2C6D.tmp 2268 2CAC.tmp 2520 2CEA.tmp 2592 2D28.tmp -
Loads dropped DLL 64 IoCs
pid Process 2080 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 2212 1999.tmp 2512 19E7.tmp 2596 1A54.tmp 2828 1AA2.tmp 3032 1B0F.tmp 2232 1B5D.tmp 2968 1BBB.tmp 2628 1C28.tmp 2432 1CA5.tmp 2572 1D12.tmp 2960 1D7F.tmp 2664 1DCD.tmp 2732 1E2B.tmp 2764 1E88.tmp 2884 1EF6.tmp 1872 1F53.tmp 860 1FC0.tmp 288 202E.tmp 1644 20AA.tmp 2656 2108.tmp 1208 2175.tmp 2036 21F2.tmp 1940 2250.tmp 2920 228E.tmp 1904 22DC.tmp 2288 231A.tmp 2672 2359.tmp 2044 23A7.tmp 596 23E5.tmp 488 2433.tmp 576 2472.tmp 1420 24C0.tmp 1808 250E.tmp 1720 255C.tmp 2356 259A.tmp 1020 25D8.tmp 2144 2617.tmp 2784 2665.tmp 2176 26A3.tmp 716 26E2.tmp 1500 2720.tmp 976 275E.tmp 764 27AC.tmp 2848 27FA.tmp 924 2839.tmp 1224 2877.tmp 2172 28B6.tmp 1968 2904.tmp 1468 2942.tmp 1916 2980.tmp 1652 29CE.tmp 2368 2A0D.tmp 1448 2A4B.tmp 1892 2A8A.tmp 2728 2AD8.tmp 1520 2B16.tmp 3004 2B54.tmp 2936 2BA2.tmp 2508 2BF0.tmp 2532 2C2F.tmp 2700 2C6D.tmp 2268 2CAC.tmp 2520 2CEA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2212 2080 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 28 PID 2080 wrote to memory of 2212 2080 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 28 PID 2080 wrote to memory of 2212 2080 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 28 PID 2080 wrote to memory of 2212 2080 2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe 28 PID 2212 wrote to memory of 2512 2212 1999.tmp 29 PID 2212 wrote to memory of 2512 2212 1999.tmp 29 PID 2212 wrote to memory of 2512 2212 1999.tmp 29 PID 2212 wrote to memory of 2512 2212 1999.tmp 29 PID 2512 wrote to memory of 2596 2512 19E7.tmp 30 PID 2512 wrote to memory of 2596 2512 19E7.tmp 30 PID 2512 wrote to memory of 2596 2512 19E7.tmp 30 PID 2512 wrote to memory of 2596 2512 19E7.tmp 30 PID 2596 wrote to memory of 2828 2596 1A54.tmp 31 PID 2596 wrote to memory of 2828 2596 1A54.tmp 31 PID 2596 wrote to memory of 2828 2596 1A54.tmp 31 PID 2596 wrote to memory of 2828 2596 1A54.tmp 31 PID 2828 wrote to memory of 3032 2828 1AA2.tmp 32 PID 2828 wrote to memory of 3032 2828 1AA2.tmp 32 PID 2828 wrote to memory of 3032 2828 1AA2.tmp 32 PID 2828 wrote to memory of 3032 2828 1AA2.tmp 32 PID 3032 wrote to memory of 2232 3032 1B0F.tmp 33 PID 3032 wrote to memory of 2232 3032 1B0F.tmp 33 PID 3032 wrote to memory of 2232 3032 1B0F.tmp 33 PID 3032 wrote to memory of 2232 3032 1B0F.tmp 33 PID 2232 wrote to memory of 2968 2232 1B5D.tmp 34 PID 2232 wrote to memory of 2968 2232 1B5D.tmp 34 PID 2232 wrote to memory of 2968 2232 1B5D.tmp 34 PID 2232 wrote to memory of 2968 2232 1B5D.tmp 34 PID 2968 wrote to memory of 2628 2968 1BBB.tmp 35 PID 2968 wrote to memory of 2628 2968 1BBB.tmp 35 PID 2968 wrote to memory of 2628 2968 1BBB.tmp 35 PID 2968 wrote to memory of 2628 2968 1BBB.tmp 35 PID 2628 wrote to memory of 2432 2628 1C28.tmp 36 PID 2628 wrote to memory of 2432 2628 1C28.tmp 36 PID 2628 wrote to memory of 2432 2628 1C28.tmp 36 PID 2628 wrote to memory of 2432 2628 1C28.tmp 36 PID 2432 wrote to memory of 2572 2432 1CA5.tmp 37 PID 2432 wrote to memory of 2572 2432 1CA5.tmp 37 PID 2432 wrote to memory of 2572 2432 1CA5.tmp 37 PID 2432 wrote to memory of 2572 2432 1CA5.tmp 37 PID 2572 wrote to memory of 2960 2572 1D12.tmp 38 PID 2572 wrote to memory of 2960 2572 1D12.tmp 38 PID 2572 wrote to memory of 2960 2572 1D12.tmp 38 PID 2572 wrote to memory of 2960 2572 1D12.tmp 38 PID 2960 wrote to memory of 2664 2960 1D7F.tmp 39 PID 2960 wrote to memory of 2664 2960 1D7F.tmp 39 PID 2960 wrote to memory of 2664 2960 1D7F.tmp 39 PID 2960 wrote to memory of 2664 2960 1D7F.tmp 39 PID 2664 wrote to memory of 2732 2664 1DCD.tmp 40 PID 2664 wrote to memory of 2732 2664 1DCD.tmp 40 PID 2664 wrote to memory of 2732 2664 1DCD.tmp 40 PID 2664 wrote to memory of 2732 2664 1DCD.tmp 40 PID 2732 wrote to memory of 2764 2732 1E2B.tmp 41 PID 2732 wrote to memory of 2764 2732 1E2B.tmp 41 PID 2732 wrote to memory of 2764 2732 1E2B.tmp 41 PID 2732 wrote to memory of 2764 2732 1E2B.tmp 41 PID 2764 wrote to memory of 2884 2764 1E88.tmp 42 PID 2764 wrote to memory of 2884 2764 1E88.tmp 42 PID 2764 wrote to memory of 2884 2764 1E88.tmp 42 PID 2764 wrote to memory of 2884 2764 1E88.tmp 42 PID 2884 wrote to memory of 1872 2884 1EF6.tmp 43 PID 2884 wrote to memory of 1872 2884 1EF6.tmp 43 PID 2884 wrote to memory of 1872 2884 1EF6.tmp 43 PID 2884 wrote to memory of 1872 2884 1EF6.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_cc991ae509fb05f7bb7984cb8e1c1e41_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"C:\Users\Admin\AppData\Local\Temp\1BBB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"65⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"67⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"68⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"69⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2E80.tmp"C:\Users\Admin\AppData\Local\Temp\2E80.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"71⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"72⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"73⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"74⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"75⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"76⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"77⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"78⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"79⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"80⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"81⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"82⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"83⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"84⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"85⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"86⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"87⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"88⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"89⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"90⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"91⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"93⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"94⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"95⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"96⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"97⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"98⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"99⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"100⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"101⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"102⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"103⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"104⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"105⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"106⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"107⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"108⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"109⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"110⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"111⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"112⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"113⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"114⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"115⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"116⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"117⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"118⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"119⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"120⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"121⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-