Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 14:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe
-
Size
536KB
-
MD5
aa8e99f0f37fe2f71614ebdb4f1531f8
-
SHA1
ae21e152258bd5d7c02a836154ea393baf8f4fda
-
SHA256
c01e8e35f3012205a537ee10a829e0ddb752739602892f8462950787ceded0c8
-
SHA512
b6a71d03c27fcd18741d013a536ff459e795645a19b4bc15c32261015eef9cb55c6e303a8686da93939bcafcd2243b09dbd64d5e770e2e3bd95f14ac1feb4efd
-
SSDEEP
12288:wU5rCOTeiUUp6YOxtmLSaMu0OhvspXEZVaIZxVJ0ZT9:wUQOJUW6vtEMxYvT+IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2068 19C8.tmp 2932 1A73.tmp 3016 1B0F.tmp 2692 1B9C.tmp 2592 1C28.tmp 2712 1C76.tmp 2324 1D22.tmp 2640 1DAE.tmp 2540 1E1B.tmp 1348 1E5A.tmp 1560 1F24.tmp 2696 1F72.tmp 2192 1FC0.tmp 1636 200E.tmp 1928 205C.tmp 288 20AA.tmp 468 20F8.tmp 1492 2156.tmp 620 21A4.tmp 1404 21F2.tmp 2232 2240.tmp 2844 228E.tmp 264 22DC.tmp 1088 232A.tmp 2724 2378.tmp 1860 23C6.tmp 1376 2414.tmp 836 2462.tmp 2092 24B0.tmp 3048 24EE.tmp 1516 254C.tmp 348 259A.tmp 1868 25E8.tmp 680 2646.tmp 2056 2694.tmp 2364 26E2.tmp 2112 2730.tmp 2796 277E.tmp 2308 27CC.tmp 1552 281A.tmp 1720 2868.tmp 2892 28B6.tmp 2160 2913.tmp 2932 2971.tmp 2996 29AF.tmp 2672 2A1C.tmp 2624 2A5B.tmp 2736 2A99.tmp 2716 2AD8.tmp 2660 2B26.tmp 2464 2B64.tmp 2176 2BA2.tmp 2916 2BE1.tmp 2588 2C1F.tmp 496 2C4E.tmp 2652 2C8C.tmp 1844 2CDA.tmp 1984 2D19.tmp 2644 2D57.tmp 1708 2D96.tmp 2340 2DD4.tmp 1784 2E12.tmp 328 2E51.tmp 808 2E8F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2180 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 2068 19C8.tmp 2932 1A73.tmp 3016 1B0F.tmp 2692 1B9C.tmp 2592 1C28.tmp 2712 1C76.tmp 2324 1D22.tmp 2640 1DAE.tmp 2540 1E1B.tmp 1348 1E5A.tmp 1560 1F24.tmp 2696 1F72.tmp 2192 1FC0.tmp 1636 200E.tmp 1928 205C.tmp 288 20AA.tmp 468 20F8.tmp 1492 2156.tmp 620 21A4.tmp 1404 21F2.tmp 2232 2240.tmp 2844 228E.tmp 264 22DC.tmp 1088 232A.tmp 2724 2378.tmp 1860 23C6.tmp 1376 2414.tmp 836 2462.tmp 2092 24B0.tmp 3048 24EE.tmp 1516 254C.tmp 348 259A.tmp 1868 25E8.tmp 680 2646.tmp 2056 2694.tmp 2364 26E2.tmp 2112 2730.tmp 2796 277E.tmp 2308 27CC.tmp 1552 281A.tmp 1720 2868.tmp 2892 28B6.tmp 2160 2913.tmp 2932 2971.tmp 2996 29AF.tmp 2672 2A1C.tmp 2624 2A5B.tmp 2736 2A99.tmp 2716 2AD8.tmp 2660 2B26.tmp 2464 2B64.tmp 2176 2BA2.tmp 2916 2BE1.tmp 2588 2C1F.tmp 496 2C4E.tmp 2652 2C8C.tmp 1844 2CDA.tmp 1984 2D19.tmp 2644 2D57.tmp 1708 2D96.tmp 2340 2DD4.tmp 1784 2E12.tmp 328 2E51.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2068 2180 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 29 PID 2180 wrote to memory of 2068 2180 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 29 PID 2180 wrote to memory of 2068 2180 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 29 PID 2180 wrote to memory of 2068 2180 2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe 29 PID 2068 wrote to memory of 2932 2068 19C8.tmp 30 PID 2068 wrote to memory of 2932 2068 19C8.tmp 30 PID 2068 wrote to memory of 2932 2068 19C8.tmp 30 PID 2068 wrote to memory of 2932 2068 19C8.tmp 30 PID 2932 wrote to memory of 3016 2932 1A73.tmp 31 PID 2932 wrote to memory of 3016 2932 1A73.tmp 31 PID 2932 wrote to memory of 3016 2932 1A73.tmp 31 PID 2932 wrote to memory of 3016 2932 1A73.tmp 31 PID 3016 wrote to memory of 2692 3016 1B0F.tmp 32 PID 3016 wrote to memory of 2692 3016 1B0F.tmp 32 PID 3016 wrote to memory of 2692 3016 1B0F.tmp 32 PID 3016 wrote to memory of 2692 3016 1B0F.tmp 32 PID 2692 wrote to memory of 2592 2692 1B9C.tmp 33 PID 2692 wrote to memory of 2592 2692 1B9C.tmp 33 PID 2692 wrote to memory of 2592 2692 1B9C.tmp 33 PID 2692 wrote to memory of 2592 2692 1B9C.tmp 33 PID 2592 wrote to memory of 2712 2592 1C28.tmp 34 PID 2592 wrote to memory of 2712 2592 1C28.tmp 34 PID 2592 wrote to memory of 2712 2592 1C28.tmp 34 PID 2592 wrote to memory of 2712 2592 1C28.tmp 34 PID 2712 wrote to memory of 2324 2712 1C76.tmp 35 PID 2712 wrote to memory of 2324 2712 1C76.tmp 35 PID 2712 wrote to memory of 2324 2712 1C76.tmp 35 PID 2712 wrote to memory of 2324 2712 1C76.tmp 35 PID 2324 wrote to memory of 2640 2324 1D22.tmp 36 PID 2324 wrote to memory of 2640 2324 1D22.tmp 36 PID 2324 wrote to memory of 2640 2324 1D22.tmp 36 PID 2324 wrote to memory of 2640 2324 1D22.tmp 36 PID 2640 wrote to memory of 2540 2640 1DAE.tmp 37 PID 2640 wrote to memory of 2540 2640 1DAE.tmp 37 PID 2640 wrote to memory of 2540 2640 1DAE.tmp 37 PID 2640 wrote to memory of 2540 2640 1DAE.tmp 37 PID 2540 wrote to memory of 1348 2540 1E1B.tmp 38 PID 2540 wrote to memory of 1348 2540 1E1B.tmp 38 PID 2540 wrote to memory of 1348 2540 1E1B.tmp 38 PID 2540 wrote to memory of 1348 2540 1E1B.tmp 38 PID 1348 wrote to memory of 1560 1348 1E5A.tmp 39 PID 1348 wrote to memory of 1560 1348 1E5A.tmp 39 PID 1348 wrote to memory of 1560 1348 1E5A.tmp 39 PID 1348 wrote to memory of 1560 1348 1E5A.tmp 39 PID 1560 wrote to memory of 2696 1560 1F24.tmp 40 PID 1560 wrote to memory of 2696 1560 1F24.tmp 40 PID 1560 wrote to memory of 2696 1560 1F24.tmp 40 PID 1560 wrote to memory of 2696 1560 1F24.tmp 40 PID 2696 wrote to memory of 2192 2696 1F72.tmp 41 PID 2696 wrote to memory of 2192 2696 1F72.tmp 41 PID 2696 wrote to memory of 2192 2696 1F72.tmp 41 PID 2696 wrote to memory of 2192 2696 1F72.tmp 41 PID 2192 wrote to memory of 1636 2192 1FC0.tmp 42 PID 2192 wrote to memory of 1636 2192 1FC0.tmp 42 PID 2192 wrote to memory of 1636 2192 1FC0.tmp 42 PID 2192 wrote to memory of 1636 2192 1FC0.tmp 42 PID 1636 wrote to memory of 1928 1636 200E.tmp 43 PID 1636 wrote to memory of 1928 1636 200E.tmp 43 PID 1636 wrote to memory of 1928 1636 200E.tmp 43 PID 1636 wrote to memory of 1928 1636 200E.tmp 43 PID 1928 wrote to memory of 288 1928 205C.tmp 44 PID 1928 wrote to memory of 288 1928 205C.tmp 44 PID 1928 wrote to memory of 288 1928 205C.tmp 44 PID 1928 wrote to memory of 288 1928 205C.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-20_aa8e99f0f37fe2f71614ebdb4f1531f8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2156.tmp"C:\Users\Admin\AppData\Local\Temp\2156.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:680 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\281A.tmp"C:\Users\Admin\AppData\Local\Temp\281A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"C:\Users\Admin\AppData\Local\Temp\2BE1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:496 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"65⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"66⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"67⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"68⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\2F89.tmp"C:\Users\Admin\AppData\Local\Temp\2F89.tmp"69⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"71⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"72⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"73⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"74⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"75⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"76⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\317C.tmp"C:\Users\Admin\AppData\Local\Temp\317C.tmp"77⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"78⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\31F9.tmp"C:\Users\Admin\AppData\Local\Temp\31F9.tmp"79⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\3237.tmp"C:\Users\Admin\AppData\Local\Temp\3237.tmp"80⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"81⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"82⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"83⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"84⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"85⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"86⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"87⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"88⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"89⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"90⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"91⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"92⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"93⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"94⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"95⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"96⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\365C.tmp"C:\Users\Admin\AppData\Local\Temp\365C.tmp"97⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"98⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"99⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3727.tmp"C:\Users\Admin\AppData\Local\Temp\3727.tmp"100⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"101⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\37A4.tmp"C:\Users\Admin\AppData\Local\Temp\37A4.tmp"102⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\37E2.tmp"C:\Users\Admin\AppData\Local\Temp\37E2.tmp"103⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\3820.tmp"C:\Users\Admin\AppData\Local\Temp\3820.tmp"104⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"105⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"106⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"107⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\391A.tmp"C:\Users\Admin\AppData\Local\Temp\391A.tmp"108⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"109⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3997.tmp"C:\Users\Admin\AppData\Local\Temp\3997.tmp"110⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\39D5.tmp"C:\Users\Admin\AppData\Local\Temp\39D5.tmp"111⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"112⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3A52.tmp"C:\Users\Admin\AppData\Local\Temp\3A52.tmp"113⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"114⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"C:\Users\Admin\AppData\Local\Temp\3ACF.tmp"115⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"C:\Users\Admin\AppData\Local\Temp\3B0D.tmp"116⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"117⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"C:\Users\Admin\AppData\Local\Temp\3B8A.tmp"118⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"119⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"120⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"121⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-