Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe
-
Size
486KB
-
MD5
73c57dcd084c75988c6d901b6013da33
-
SHA1
4a6f27fc883497c0f9e92b92c91172e05b1e00c4
-
SHA256
3e714519b1fefba534d2b70ece3baeffc18cc30b37d16dd99d22569b51430d70
-
SHA512
e367bca15241dac673a21cb2bfd220e66f225ab94e897a3ce73f1d66d6ac88cea45e169868a145db4447b4dd638a43db6e2cf48d28f1043ddabe6205633fea97
-
SSDEEP
12288:/U5rCOTeiDQzYvkuI9V8r/H2afxtGdC2Ze9NZ:/UQOJDQzYvrI9Kr/WafxtG/ZyN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1756 4AB6.tmp 2912 4BA0.tmp 1536 4CB9.tmp 1632 4D94.tmp 3040 4E4F.tmp 2516 4EFA.tmp 2660 4FB6.tmp 2420 50A0.tmp 2528 51A9.tmp 2436 5283.tmp 2580 532F.tmp 2424 53FA.tmp 2532 54D4.tmp 1264 5580.tmp 1760 565A.tmp 268 5734.tmp 992 57FF.tmp 2608 58DA.tmp 2244 59B4.tmp 1576 5A50.tmp 2400 5B1B.tmp 1480 5BF5.tmp 920 5D3D.tmp 2784 5DBA.tmp 304 5E56.tmp 1684 5ED2.tmp 1508 5F40.tmp 1772 5F9D.tmp 2832 601A.tmp 2788 6078.tmp 2196 60D5.tmp 2276 6152.tmp 1164 61B0.tmp 2512 623C.tmp 2816 629A.tmp 2592 6307.tmp 1704 6374.tmp 2656 63F1.tmp 832 647D.tmp 1912 64EB.tmp 2260 6558.tmp 1816 65D5.tmp 1636 6651.tmp 1728 66AF.tmp 2504 671C.tmp 960 6799.tmp 1416 6806.tmp 1200 6873.tmp 820 68E1.tmp 340 694E.tmp 2000 69BB.tmp 1312 6A28.tmp 2024 6A95.tmp 1612 6B12.tmp 1392 6B7F.tmp 2192 6BED.tmp 2928 6C5A.tmp 2988 6CC7.tmp 2912 6D53.tmp 1536 6DD0.tmp 2300 6E2E.tmp 3056 6EBA.tmp 1144 6F18.tmp 2640 6F75.tmp -
Loads dropped DLL 64 IoCs
pid Process 2236 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 1756 4AB6.tmp 2912 4BA0.tmp 1536 4CB9.tmp 1632 4D94.tmp 3040 4E4F.tmp 2516 4EFA.tmp 2660 4FB6.tmp 2420 50A0.tmp 2528 51A9.tmp 2436 5283.tmp 2580 532F.tmp 2424 53FA.tmp 2532 54D4.tmp 1264 5580.tmp 1760 565A.tmp 268 5734.tmp 992 57FF.tmp 2608 58DA.tmp 2244 59B4.tmp 1576 5A50.tmp 2400 5B1B.tmp 1480 5BF5.tmp 920 5D3D.tmp 2784 5DBA.tmp 304 5E56.tmp 1684 5ED2.tmp 1508 5F40.tmp 1772 5F9D.tmp 2832 601A.tmp 2788 6078.tmp 2196 60D5.tmp 2276 6152.tmp 1164 61B0.tmp 2512 623C.tmp 2816 629A.tmp 2592 6307.tmp 1704 6374.tmp 2656 63F1.tmp 832 647D.tmp 1912 64EB.tmp 2260 6558.tmp 1816 65D5.tmp 1636 6651.tmp 1728 66AF.tmp 2504 671C.tmp 960 6799.tmp 1416 6806.tmp 1200 6873.tmp 820 68E1.tmp 340 694E.tmp 2000 69BB.tmp 1312 6A28.tmp 2024 6A95.tmp 1612 6B12.tmp 1392 6B7F.tmp 2192 6BED.tmp 2928 6C5A.tmp 2988 6CC7.tmp 2912 6D53.tmp 1536 6DD0.tmp 2300 6E2E.tmp 3056 6EBA.tmp 1144 6F18.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1756 2236 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 28 PID 2236 wrote to memory of 1756 2236 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 28 PID 2236 wrote to memory of 1756 2236 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 28 PID 2236 wrote to memory of 1756 2236 2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe 28 PID 1756 wrote to memory of 2912 1756 4AB6.tmp 29 PID 1756 wrote to memory of 2912 1756 4AB6.tmp 29 PID 1756 wrote to memory of 2912 1756 4AB6.tmp 29 PID 1756 wrote to memory of 2912 1756 4AB6.tmp 29 PID 2912 wrote to memory of 1536 2912 4BA0.tmp 30 PID 2912 wrote to memory of 1536 2912 4BA0.tmp 30 PID 2912 wrote to memory of 1536 2912 4BA0.tmp 30 PID 2912 wrote to memory of 1536 2912 4BA0.tmp 30 PID 1536 wrote to memory of 1632 1536 4CB9.tmp 31 PID 1536 wrote to memory of 1632 1536 4CB9.tmp 31 PID 1536 wrote to memory of 1632 1536 4CB9.tmp 31 PID 1536 wrote to memory of 1632 1536 4CB9.tmp 31 PID 1632 wrote to memory of 3040 1632 4D94.tmp 32 PID 1632 wrote to memory of 3040 1632 4D94.tmp 32 PID 1632 wrote to memory of 3040 1632 4D94.tmp 32 PID 1632 wrote to memory of 3040 1632 4D94.tmp 32 PID 3040 wrote to memory of 2516 3040 4E4F.tmp 33 PID 3040 wrote to memory of 2516 3040 4E4F.tmp 33 PID 3040 wrote to memory of 2516 3040 4E4F.tmp 33 PID 3040 wrote to memory of 2516 3040 4E4F.tmp 33 PID 2516 wrote to memory of 2660 2516 4EFA.tmp 34 PID 2516 wrote to memory of 2660 2516 4EFA.tmp 34 PID 2516 wrote to memory of 2660 2516 4EFA.tmp 34 PID 2516 wrote to memory of 2660 2516 4EFA.tmp 34 PID 2660 wrote to memory of 2420 2660 4FB6.tmp 35 PID 2660 wrote to memory of 2420 2660 4FB6.tmp 35 PID 2660 wrote to memory of 2420 2660 4FB6.tmp 35 PID 2660 wrote to memory of 2420 2660 4FB6.tmp 35 PID 2420 wrote to memory of 2528 2420 50A0.tmp 36 PID 2420 wrote to memory of 2528 2420 50A0.tmp 36 PID 2420 wrote to memory of 2528 2420 50A0.tmp 36 PID 2420 wrote to memory of 2528 2420 50A0.tmp 36 PID 2528 wrote to memory of 2436 2528 51A9.tmp 37 PID 2528 wrote to memory of 2436 2528 51A9.tmp 37 PID 2528 wrote to memory of 2436 2528 51A9.tmp 37 PID 2528 wrote to memory of 2436 2528 51A9.tmp 37 PID 2436 wrote to memory of 2580 2436 5283.tmp 38 PID 2436 wrote to memory of 2580 2436 5283.tmp 38 PID 2436 wrote to memory of 2580 2436 5283.tmp 38 PID 2436 wrote to memory of 2580 2436 5283.tmp 38 PID 2580 wrote to memory of 2424 2580 532F.tmp 39 PID 2580 wrote to memory of 2424 2580 532F.tmp 39 PID 2580 wrote to memory of 2424 2580 532F.tmp 39 PID 2580 wrote to memory of 2424 2580 532F.tmp 39 PID 2424 wrote to memory of 2532 2424 53FA.tmp 40 PID 2424 wrote to memory of 2532 2424 53FA.tmp 40 PID 2424 wrote to memory of 2532 2424 53FA.tmp 40 PID 2424 wrote to memory of 2532 2424 53FA.tmp 40 PID 2532 wrote to memory of 1264 2532 54D4.tmp 41 PID 2532 wrote to memory of 1264 2532 54D4.tmp 41 PID 2532 wrote to memory of 1264 2532 54D4.tmp 41 PID 2532 wrote to memory of 1264 2532 54D4.tmp 41 PID 1264 wrote to memory of 1760 1264 5580.tmp 42 PID 1264 wrote to memory of 1760 1264 5580.tmp 42 PID 1264 wrote to memory of 1760 1264 5580.tmp 42 PID 1264 wrote to memory of 1760 1264 5580.tmp 42 PID 1760 wrote to memory of 268 1760 565A.tmp 43 PID 1760 wrote to memory of 268 1760 565A.tmp 43 PID 1760 wrote to memory of 268 1760 565A.tmp 43 PID 1760 wrote to memory of 268 1760 565A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_73c57dcd084c75988c6d901b6013da33_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"C:\Users\Admin\AppData\Local\Temp\4BA0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\53FA.tmp"C:\Users\Admin\AppData\Local\Temp\53FA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:820 -
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"65⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"66⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"67⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"68⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\70FB.tmp"C:\Users\Admin\AppData\Local\Temp\70FB.tmp"69⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"70⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"71⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"73⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"74⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"75⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"76⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\760A.tmp"C:\Users\Admin\AppData\Local\Temp\760A.tmp"77⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"78⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"79⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\7742.tmp"C:\Users\Admin\AppData\Local\Temp\7742.tmp"80⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"81⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\782C.tmp"C:\Users\Admin\AppData\Local\Temp\782C.tmp"82⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"83⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"84⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"85⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"86⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"87⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"88⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"89⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"91⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"92⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"93⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"94⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\7E25.tmp"C:\Users\Admin\AppData\Local\Temp\7E25.tmp"95⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"C:\Users\Admin\AppData\Local\Temp\7EA2.tmp"96⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"97⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"98⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"100⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"101⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"102⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"103⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"104⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"105⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"106⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"107⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\83C0.tmp"C:\Users\Admin\AppData\Local\Temp\83C0.tmp"108⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"109⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"110⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"112⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"113⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\868E.tmp"C:\Users\Admin\AppData\Local\Temp\868E.tmp"114⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"115⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"116⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"117⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"118⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"119⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"120⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\8A07.tmp"C:\Users\Admin\AppData\Local\Temp\8A07.tmp"121⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-