Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe
-
Size
487KB
-
MD5
7057384ea1726c24215b4ed16677f69e
-
SHA1
626d98946766661f3b1f802b29c26623102385f8
-
SHA256
50199b5b44f765b673ab2893232c1391e0c64edbdb20979771bf29d6dbe35b54
-
SHA512
54082e5194b411b6195e0f42897155f9fc822b8162d911b3df6144dcbe4715daf8e8e3eae37578e265abd97faf05a2719b50a04d6b2ec9d840bcefc54832f129
-
SSDEEP
12288:yU5rCOTeiNbd4w7EWvlVpuRRxbolZ+k+0xbZ:yUQOJNbd4w7RtuRDbousb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1680 13CF.tmp 2156 142C.tmp 2988 14A9.tmp 2556 1507.tmp 2644 1564.tmp 2592 15D2.tmp 2276 163F.tmp 2716 169C.tmp 2796 170A.tmp 2452 1758.tmp 2524 17B5.tmp 2904 1813.tmp 1972 1870.tmp 2536 18BE.tmp 2684 191C.tmp 2792 196A.tmp 2224 19D7.tmp 1872 1A25.tmp 1452 1A73.tmp 1992 1AB2.tmp 1920 1B0F.tmp 1072 1B5D.tmp 2176 1BAB.tmp 1080 1BEA.tmp 2244 1C28.tmp 2252 1C66.tmp 2692 1CA5.tmp 1536 1CE3.tmp 2852 1D41.tmp 2256 1D7F.tmp 604 1DBE.tmp 800 1DFC.tmp 1300 1E3A.tmp 664 1E88.tmp 1856 1EC7.tmp 1796 1F05.tmp 1516 1F53.tmp 404 1FA1.tmp 2392 1FE0.tmp 292 201E.tmp 1268 205C.tmp 1236 209B.tmp 1380 20E9.tmp 1308 2127.tmp 2336 2175.tmp 920 21B4.tmp 2836 2202.tmp 1316 2240.tmp 2324 227E.tmp 1540 22BD.tmp 1808 22FB.tmp 2076 233A.tmp 2896 2378.tmp 2532 23B6.tmp 2372 23F5.tmp 1616 2433.tmp 3020 2472.tmp 2940 24B0.tmp 2168 24EE.tmp 2968 252D.tmp 2576 256B.tmp 2668 25AA.tmp 2660 25E8.tmp 2580 2626.tmp -
Loads dropped DLL 64 IoCs
pid Process 2936 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 1680 13CF.tmp 2156 142C.tmp 2988 14A9.tmp 2556 1507.tmp 2644 1564.tmp 2592 15D2.tmp 2276 163F.tmp 2716 169C.tmp 2796 170A.tmp 2452 1758.tmp 2524 17B5.tmp 2904 1813.tmp 1972 1870.tmp 2536 18BE.tmp 2684 191C.tmp 2792 196A.tmp 2224 19D7.tmp 1872 1A25.tmp 1452 1A73.tmp 1992 1AB2.tmp 1920 1B0F.tmp 1072 1B5D.tmp 2176 1BAB.tmp 1080 1BEA.tmp 2244 1C28.tmp 2252 1C66.tmp 2692 1CA5.tmp 1536 1CE3.tmp 2852 1D41.tmp 2256 1D7F.tmp 604 1DBE.tmp 800 1DFC.tmp 1300 1E3A.tmp 664 1E88.tmp 1856 1EC7.tmp 1796 1F05.tmp 1516 1F53.tmp 404 1FA1.tmp 2392 1FE0.tmp 292 201E.tmp 1268 205C.tmp 1236 209B.tmp 1380 20E9.tmp 1308 2127.tmp 2336 2175.tmp 920 21B4.tmp 2836 2202.tmp 1316 2240.tmp 2324 227E.tmp 1540 22BD.tmp 1808 22FB.tmp 2076 233A.tmp 2896 2378.tmp 2532 23B6.tmp 2372 23F5.tmp 1616 2433.tmp 3020 2472.tmp 2940 24B0.tmp 2168 24EE.tmp 2968 252D.tmp 2576 256B.tmp 2668 25AA.tmp 2660 25E8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 1680 2936 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 28 PID 2936 wrote to memory of 1680 2936 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 28 PID 2936 wrote to memory of 1680 2936 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 28 PID 2936 wrote to memory of 1680 2936 2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe 28 PID 1680 wrote to memory of 2156 1680 13CF.tmp 29 PID 1680 wrote to memory of 2156 1680 13CF.tmp 29 PID 1680 wrote to memory of 2156 1680 13CF.tmp 29 PID 1680 wrote to memory of 2156 1680 13CF.tmp 29 PID 2156 wrote to memory of 2988 2156 142C.tmp 30 PID 2156 wrote to memory of 2988 2156 142C.tmp 30 PID 2156 wrote to memory of 2988 2156 142C.tmp 30 PID 2156 wrote to memory of 2988 2156 142C.tmp 30 PID 2988 wrote to memory of 2556 2988 14A9.tmp 31 PID 2988 wrote to memory of 2556 2988 14A9.tmp 31 PID 2988 wrote to memory of 2556 2988 14A9.tmp 31 PID 2988 wrote to memory of 2556 2988 14A9.tmp 31 PID 2556 wrote to memory of 2644 2556 1507.tmp 32 PID 2556 wrote to memory of 2644 2556 1507.tmp 32 PID 2556 wrote to memory of 2644 2556 1507.tmp 32 PID 2556 wrote to memory of 2644 2556 1507.tmp 32 PID 2644 wrote to memory of 2592 2644 1564.tmp 33 PID 2644 wrote to memory of 2592 2644 1564.tmp 33 PID 2644 wrote to memory of 2592 2644 1564.tmp 33 PID 2644 wrote to memory of 2592 2644 1564.tmp 33 PID 2592 wrote to memory of 2276 2592 15D2.tmp 34 PID 2592 wrote to memory of 2276 2592 15D2.tmp 34 PID 2592 wrote to memory of 2276 2592 15D2.tmp 34 PID 2592 wrote to memory of 2276 2592 15D2.tmp 34 PID 2276 wrote to memory of 2716 2276 163F.tmp 35 PID 2276 wrote to memory of 2716 2276 163F.tmp 35 PID 2276 wrote to memory of 2716 2276 163F.tmp 35 PID 2276 wrote to memory of 2716 2276 163F.tmp 35 PID 2716 wrote to memory of 2796 2716 169C.tmp 36 PID 2716 wrote to memory of 2796 2716 169C.tmp 36 PID 2716 wrote to memory of 2796 2716 169C.tmp 36 PID 2716 wrote to memory of 2796 2716 169C.tmp 36 PID 2796 wrote to memory of 2452 2796 170A.tmp 37 PID 2796 wrote to memory of 2452 2796 170A.tmp 37 PID 2796 wrote to memory of 2452 2796 170A.tmp 37 PID 2796 wrote to memory of 2452 2796 170A.tmp 37 PID 2452 wrote to memory of 2524 2452 1758.tmp 38 PID 2452 wrote to memory of 2524 2452 1758.tmp 38 PID 2452 wrote to memory of 2524 2452 1758.tmp 38 PID 2452 wrote to memory of 2524 2452 1758.tmp 38 PID 2524 wrote to memory of 2904 2524 17B5.tmp 39 PID 2524 wrote to memory of 2904 2524 17B5.tmp 39 PID 2524 wrote to memory of 2904 2524 17B5.tmp 39 PID 2524 wrote to memory of 2904 2524 17B5.tmp 39 PID 2904 wrote to memory of 1972 2904 1813.tmp 40 PID 2904 wrote to memory of 1972 2904 1813.tmp 40 PID 2904 wrote to memory of 1972 2904 1813.tmp 40 PID 2904 wrote to memory of 1972 2904 1813.tmp 40 PID 1972 wrote to memory of 2536 1972 1870.tmp 41 PID 1972 wrote to memory of 2536 1972 1870.tmp 41 PID 1972 wrote to memory of 2536 1972 1870.tmp 41 PID 1972 wrote to memory of 2536 1972 1870.tmp 41 PID 2536 wrote to memory of 2684 2536 18BE.tmp 42 PID 2536 wrote to memory of 2684 2536 18BE.tmp 42 PID 2536 wrote to memory of 2684 2536 18BE.tmp 42 PID 2536 wrote to memory of 2684 2536 18BE.tmp 42 PID 2684 wrote to memory of 2792 2684 191C.tmp 43 PID 2684 wrote to memory of 2792 2684 191C.tmp 43 PID 2684 wrote to memory of 2792 2684 191C.tmp 43 PID 2684 wrote to memory of 2792 2684 191C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_7057384ea1726c24215b4ed16677f69e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\142C.tmp"C:\Users\Admin\AppData\Local\Temp\142C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\14A9.tmp"C:\Users\Admin\AppData\Local\Temp\14A9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\163F.tmp"C:\Users\Admin\AppData\Local\Temp\163F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\18BE.tmp"C:\Users\Admin\AppData\Local\Temp\18BE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:664 -
C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"C:\Users\Admin\AppData\Local\Temp\1EC7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\1F53.tmp"C:\Users\Admin\AppData\Local\Temp\1F53.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\227E.tmp"C:\Users\Admin\AppData\Local\Temp\227E.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"65⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"66⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"67⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"68⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"69⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\276E.tmp"C:\Users\Admin\AppData\Local\Temp\276E.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"71⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"73⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"74⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"75⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\28D5.tmp"C:\Users\Admin\AppData\Local\Temp\28D5.tmp"76⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"78⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"79⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"80⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"81⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"82⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"83⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"84⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"85⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"86⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"87⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"88⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"89⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"90⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"91⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"92⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"93⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"94⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"95⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"96⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"97⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"98⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"99⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"100⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"101⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"102⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"103⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"104⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"105⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"106⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"107⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"108⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"109⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"110⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"111⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"112⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"113⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"114⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"115⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"116⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"117⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"118⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"119⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"120⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"121⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"122⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-