Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe
-
Size
488KB
-
MD5
217a02331e3bd240166f9056eb44bf10
-
SHA1
ec5765518a45e1c13828536e6d30b6ac75a6ea6b
-
SHA256
49d3e5b45b97dbf0189af43eb6ddb3b9779470484599223cfea1b31cf5f834df
-
SHA512
c0c75371796e6ef13fdf843d937bd235f33b6819b2152cf56650d187d12f790960efc5cf15a275a36d4555d3eabad3e6d963b2cb9f9160d9334d194c4b600126
-
SSDEEP
12288:/U5rCOTeiD3IgM2JnsiwFui52HTJVv67FNZ:/UQOJD/MAQui52H1BUN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2008 11EB.tmp 3028 1249.tmp 2844 12B6.tmp 2528 1314.tmp 2592 1371.tmp 2544 13CF.tmp 2504 142C.tmp 2732 148A.tmp 2560 14F7.tmp 2380 1555.tmp 2456 15C2.tmp 2856 1610.tmp 1584 166E.tmp 1552 16CB.tmp 2676 1738.tmp 2720 1786.tmp 1236 17E4.tmp 1648 1861.tmp 1020 18CE.tmp 1912 192C.tmp 2340 1989.tmp 1624 1A06.tmp 2292 1A64.tmp 628 1AA2.tmp 1392 1AE0.tmp 2248 1B2E.tmp 2424 1B6D.tmp 2368 1BAB.tmp 1300 1BEA.tmp 2796 1C38.tmp 2224 1C76.tmp 336 1CC4.tmp 988 1D02.tmp 584 1D50.tmp 1548 1D8F.tmp 2752 1DDD.tmp 1104 1E1B.tmp 1348 1E5A.tmp 1132 1E98.tmp 2944 1EE6.tmp 2976 1F24.tmp 276 1F72.tmp 1544 1FB1.tmp 1368 1FFF.tmp 1848 203D.tmp 2764 208B.tmp 1308 20CA.tmp 1152 2108.tmp 2900 2146.tmp 1736 2185.tmp 1160 21D3.tmp 1792 2211.tmp 348 2250.tmp 1504 228E.tmp 3000 22DC.tmp 2812 231A.tmp 1608 2359.tmp 2468 2397.tmp 2080 23E5.tmp 2656 2424.tmp 2200 2462.tmp 2572 24B0.tmp 2536 24FE.tmp 2528 254C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2192 2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe 2008 11EB.tmp 3028 1249.tmp 2844 12B6.tmp 2528 1314.tmp 2592 1371.tmp 2544 13CF.tmp 2504 142C.tmp 2732 148A.tmp 2560 14F7.tmp 2380 1555.tmp 2456 15C2.tmp 2856 1610.tmp 1584 166E.tmp 1552 16CB.tmp 2676 1738.tmp 2720 1786.tmp 1236 17E4.tmp 1648 1861.tmp 1020 18CE.tmp 1912 192C.tmp 2340 1989.tmp 1624 1A06.tmp 2292 1A64.tmp 628 1AA2.tmp 1392 1AE0.tmp 2248 1B2E.tmp 2424 1B6D.tmp 2368 1BAB.tmp 1300 1BEA.tmp 2796 1C38.tmp 2224 1C76.tmp 336 1CC4.tmp 988 1D02.tmp 584 1D50.tmp 1548 1D8F.tmp 2752 1DDD.tmp 1104 1E1B.tmp 1348 1E5A.tmp 1132 1E98.tmp 2944 1EE6.tmp 2976 1F24.tmp 276 1F72.tmp 1544 1FB1.tmp 1368 1FFF.tmp 1848 203D.tmp 2764 208B.tmp 1308 20CA.tmp 1152 2108.tmp 2900 2146.tmp 1736 2185.tmp 1160 21D3.tmp 1792 2211.tmp 348 2250.tmp 1504 228E.tmp 3000 22DC.tmp 2812 231A.tmp 1608 2359.tmp 2468 2397.tmp 2080 23E5.tmp 2656 2424.tmp 2200 2462.tmp 2572 24B0.tmp 2536 24FE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2008 2192 2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe 28 PID 2192 wrote to memory of 2008 2192 2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe 28 PID 2192 wrote to memory of 2008 2192 2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe 28 PID 2192 wrote to memory of 2008 2192 2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe 28 PID 2008 wrote to memory of 3028 2008 11EB.tmp 29 PID 2008 wrote to memory of 3028 2008 11EB.tmp 29 PID 2008 wrote to memory of 3028 2008 11EB.tmp 29 PID 2008 wrote to memory of 3028 2008 11EB.tmp 29 PID 3028 wrote to memory of 2844 3028 1249.tmp 30 PID 3028 wrote to memory of 2844 3028 1249.tmp 30 PID 3028 wrote to memory of 2844 3028 1249.tmp 30 PID 3028 wrote to memory of 2844 3028 1249.tmp 30 PID 2844 wrote to memory of 2528 2844 12B6.tmp 31 PID 2844 wrote to memory of 2528 2844 12B6.tmp 31 PID 2844 wrote to memory of 2528 2844 12B6.tmp 31 PID 2844 wrote to memory of 2528 2844 12B6.tmp 31 PID 2528 wrote to memory of 2592 2528 1314.tmp 32 PID 2528 wrote to memory of 2592 2528 1314.tmp 32 PID 2528 wrote to memory of 2592 2528 1314.tmp 32 PID 2528 wrote to memory of 2592 2528 1314.tmp 32 PID 2592 wrote to memory of 2544 2592 1371.tmp 33 PID 2592 wrote to memory of 2544 2592 1371.tmp 33 PID 2592 wrote to memory of 2544 2592 1371.tmp 33 PID 2592 wrote to memory of 2544 2592 1371.tmp 33 PID 2544 wrote to memory of 2504 2544 13CF.tmp 34 PID 2544 wrote to memory of 2504 2544 13CF.tmp 34 PID 2544 wrote to memory of 2504 2544 13CF.tmp 34 PID 2544 wrote to memory of 2504 2544 13CF.tmp 34 PID 2504 wrote to memory of 2732 2504 142C.tmp 35 PID 2504 wrote to memory of 2732 2504 142C.tmp 35 PID 2504 wrote to memory of 2732 2504 142C.tmp 35 PID 2504 wrote to memory of 2732 2504 142C.tmp 35 PID 2732 wrote to memory of 2560 2732 148A.tmp 36 PID 2732 wrote to memory of 2560 2732 148A.tmp 36 PID 2732 wrote to memory of 2560 2732 148A.tmp 36 PID 2732 wrote to memory of 2560 2732 148A.tmp 36 PID 2560 wrote to memory of 2380 2560 14F7.tmp 37 PID 2560 wrote to memory of 2380 2560 14F7.tmp 37 PID 2560 wrote to memory of 2380 2560 14F7.tmp 37 PID 2560 wrote to memory of 2380 2560 14F7.tmp 37 PID 2380 wrote to memory of 2456 2380 1555.tmp 38 PID 2380 wrote to memory of 2456 2380 1555.tmp 38 PID 2380 wrote to memory of 2456 2380 1555.tmp 38 PID 2380 wrote to memory of 2456 2380 1555.tmp 38 PID 2456 wrote to memory of 2856 2456 15C2.tmp 39 PID 2456 wrote to memory of 2856 2456 15C2.tmp 39 PID 2456 wrote to memory of 2856 2456 15C2.tmp 39 PID 2456 wrote to memory of 2856 2456 15C2.tmp 39 PID 2856 wrote to memory of 1584 2856 1610.tmp 40 PID 2856 wrote to memory of 1584 2856 1610.tmp 40 PID 2856 wrote to memory of 1584 2856 1610.tmp 40 PID 2856 wrote to memory of 1584 2856 1610.tmp 40 PID 1584 wrote to memory of 1552 1584 166E.tmp 41 PID 1584 wrote to memory of 1552 1584 166E.tmp 41 PID 1584 wrote to memory of 1552 1584 166E.tmp 41 PID 1584 wrote to memory of 1552 1584 166E.tmp 41 PID 1552 wrote to memory of 2676 1552 16CB.tmp 42 PID 1552 wrote to memory of 2676 1552 16CB.tmp 42 PID 1552 wrote to memory of 2676 1552 16CB.tmp 42 PID 1552 wrote to memory of 2676 1552 16CB.tmp 42 PID 2676 wrote to memory of 2720 2676 1738.tmp 43 PID 2676 wrote to memory of 2720 2676 1738.tmp 43 PID 2676 wrote to memory of 2720 2676 1738.tmp 43 PID 2676 wrote to memory of 2720 2676 1738.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_217a02331e3bd240166f9056eb44bf10_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\14F7.tmp"C:\Users\Admin\AppData\Local\Temp\14F7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\1D02.tmp"C:\Users\Admin\AppData\Local\Temp\1D02.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"C:\Users\Admin\AppData\Local\Temp\1D8F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\20CA.tmp"C:\Users\Admin\AppData\Local\Temp\20CA.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\2185.tmp"C:\Users\Admin\AppData\Local\Temp\2185.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2424.tmp"C:\Users\Admin\AppData\Local\Temp\2424.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"65⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"66⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"67⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"68⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"70⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"71⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"72⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"73⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"74⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"75⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"76⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"77⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"79⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"80⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"81⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"82⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"83⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"84⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"85⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"86⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"87⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"88⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"89⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"91⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"92⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"C:\Users\Admin\AppData\Local\Temp\2C9C.tmp"93⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"94⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"95⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"96⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"98⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"99⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"100⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"101⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"102⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"103⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"104⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"105⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"106⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"107⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"108⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"109⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"110⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"111⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"112⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"113⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"114⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"115⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"116⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"117⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"118⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"119⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"120⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"121⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-