Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe
-
Size
536KB
-
MD5
8026f7616083c3a549aba37e1c859d84
-
SHA1
bfdf42ff977c96f1077ed15e79534d03e6104ed6
-
SHA256
d005e32e30f6defc7d6bfa4d90bca90a5717c40e7bb47b7f284d882a28de0854
-
SHA512
fb806df42875c06f53f19011311064f0de0c6533b9465c9120c103fb53538fcb56f18d64270dfe3bb829f265831053af82d5917721e3e3ea35e99b8ed3b48b6f
-
SSDEEP
12288:wU5rCOTeiUHfkZObvZH4qXKrKS35+ozOH0IZxVJ0ZT9:wUQOJUsObBHOKa5o0IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1820 511C.tmp 2364 51A9.tmp 1612 5254.tmp 1960 52E1.tmp 2244 538C.tmp 2028 5428.tmp 576 54D4.tmp 1164 559F.tmp 1736 564A.tmp 2404 56E6.tmp 364 5783.tmp 2488 581F.tmp 1332 58CA.tmp 2888 5976.tmp 2544 5A50.tmp 2668 5AFC.tmp 2864 5BA7.tmp 2520 5C43.tmp 2920 5CEF.tmp 2916 5DAA.tmp 3008 5E46.tmp 3060 5F21.tmp 768 5FCC.tmp 1604 6068.tmp 1688 6133.tmp 2424 62B9.tmp 1724 6384.tmp 1292 642F.tmp 2796 64DB.tmp 848 6596.tmp 2064 6642.tmp 2148 66ED.tmp 2120 6799.tmp 2288 6816.tmp 2264 68D1.tmp 2096 697D.tmp 2280 6A38.tmp 2040 6AE3.tmp 1588 6B60.tmp 2368 6BDD.tmp 1668 6C98.tmp 1964 6D53.tmp 596 6DFF.tmp 776 6EAB.tmp 2168 6F66.tmp 2480 7002.tmp 2352 709E.tmp 2008 7159.tmp 2656 7205.tmp 676 72C0.tmp 784 738B.tmp 3004 7427.tmp 2992 7484.tmp 2956 7511.tmp 2672 757E.tmp 2764 75EB.tmp 1472 7658.tmp 1032 76D5.tmp 2624 7771.tmp 2112 7907.tmp 1764 79B2.tmp 1808 7A4E.tmp 1872 7ABB.tmp 2924 7B09.tmp -
Loads dropped DLL 64 IoCs
pid Process 2336 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 1820 511C.tmp 2364 51A9.tmp 1612 5254.tmp 1960 52E1.tmp 2244 538C.tmp 2028 5428.tmp 576 54D4.tmp 1164 559F.tmp 1736 564A.tmp 2404 56E6.tmp 364 5783.tmp 2488 581F.tmp 1332 58CA.tmp 2888 5976.tmp 2544 5A50.tmp 2668 5AFC.tmp 2864 5BA7.tmp 2520 5C43.tmp 2920 5CEF.tmp 2916 5DAA.tmp 3008 5E46.tmp 3060 5F21.tmp 768 5FCC.tmp 1604 6068.tmp 1688 6133.tmp 2424 62B9.tmp 1724 6384.tmp 1292 642F.tmp 2796 64DB.tmp 848 6596.tmp 2064 6642.tmp 2148 66ED.tmp 2120 6799.tmp 2288 6816.tmp 2264 68D1.tmp 2096 697D.tmp 2280 6A38.tmp 2040 6AE3.tmp 1588 6B60.tmp 2368 6BDD.tmp 1668 6C98.tmp 1964 6D53.tmp 596 6DFF.tmp 776 6EAB.tmp 2168 6F66.tmp 2480 7002.tmp 2352 709E.tmp 2008 7159.tmp 2656 7205.tmp 676 72C0.tmp 784 738B.tmp 3004 7427.tmp 2992 7484.tmp 2956 7511.tmp 2672 757E.tmp 2764 75EB.tmp 1472 7658.tmp 1032 76D5.tmp 2624 7771.tmp 2112 7907.tmp 1764 79B2.tmp 1808 7A4E.tmp 1872 7ABB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1820 2336 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 30 PID 2336 wrote to memory of 1820 2336 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 30 PID 2336 wrote to memory of 1820 2336 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 30 PID 2336 wrote to memory of 1820 2336 2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe 30 PID 1820 wrote to memory of 2364 1820 511C.tmp 31 PID 1820 wrote to memory of 2364 1820 511C.tmp 31 PID 1820 wrote to memory of 2364 1820 511C.tmp 31 PID 1820 wrote to memory of 2364 1820 511C.tmp 31 PID 2364 wrote to memory of 1612 2364 51A9.tmp 32 PID 2364 wrote to memory of 1612 2364 51A9.tmp 32 PID 2364 wrote to memory of 1612 2364 51A9.tmp 32 PID 2364 wrote to memory of 1612 2364 51A9.tmp 32 PID 1612 wrote to memory of 1960 1612 5254.tmp 33 PID 1612 wrote to memory of 1960 1612 5254.tmp 33 PID 1612 wrote to memory of 1960 1612 5254.tmp 33 PID 1612 wrote to memory of 1960 1612 5254.tmp 33 PID 1960 wrote to memory of 2244 1960 52E1.tmp 34 PID 1960 wrote to memory of 2244 1960 52E1.tmp 34 PID 1960 wrote to memory of 2244 1960 52E1.tmp 34 PID 1960 wrote to memory of 2244 1960 52E1.tmp 34 PID 2244 wrote to memory of 2028 2244 538C.tmp 35 PID 2244 wrote to memory of 2028 2244 538C.tmp 35 PID 2244 wrote to memory of 2028 2244 538C.tmp 35 PID 2244 wrote to memory of 2028 2244 538C.tmp 35 PID 2028 wrote to memory of 576 2028 5428.tmp 36 PID 2028 wrote to memory of 576 2028 5428.tmp 36 PID 2028 wrote to memory of 576 2028 5428.tmp 36 PID 2028 wrote to memory of 576 2028 5428.tmp 36 PID 576 wrote to memory of 1164 576 54D4.tmp 37 PID 576 wrote to memory of 1164 576 54D4.tmp 37 PID 576 wrote to memory of 1164 576 54D4.tmp 37 PID 576 wrote to memory of 1164 576 54D4.tmp 37 PID 1164 wrote to memory of 1736 1164 559F.tmp 38 PID 1164 wrote to memory of 1736 1164 559F.tmp 38 PID 1164 wrote to memory of 1736 1164 559F.tmp 38 PID 1164 wrote to memory of 1736 1164 559F.tmp 38 PID 1736 wrote to memory of 2404 1736 564A.tmp 39 PID 1736 wrote to memory of 2404 1736 564A.tmp 39 PID 1736 wrote to memory of 2404 1736 564A.tmp 39 PID 1736 wrote to memory of 2404 1736 564A.tmp 39 PID 2404 wrote to memory of 364 2404 56E6.tmp 40 PID 2404 wrote to memory of 364 2404 56E6.tmp 40 PID 2404 wrote to memory of 364 2404 56E6.tmp 40 PID 2404 wrote to memory of 364 2404 56E6.tmp 40 PID 364 wrote to memory of 2488 364 5783.tmp 41 PID 364 wrote to memory of 2488 364 5783.tmp 41 PID 364 wrote to memory of 2488 364 5783.tmp 41 PID 364 wrote to memory of 2488 364 5783.tmp 41 PID 2488 wrote to memory of 1332 2488 581F.tmp 42 PID 2488 wrote to memory of 1332 2488 581F.tmp 42 PID 2488 wrote to memory of 1332 2488 581F.tmp 42 PID 2488 wrote to memory of 1332 2488 581F.tmp 42 PID 1332 wrote to memory of 2888 1332 58CA.tmp 43 PID 1332 wrote to memory of 2888 1332 58CA.tmp 43 PID 1332 wrote to memory of 2888 1332 58CA.tmp 43 PID 1332 wrote to memory of 2888 1332 58CA.tmp 43 PID 2888 wrote to memory of 2544 2888 5976.tmp 44 PID 2888 wrote to memory of 2544 2888 5976.tmp 44 PID 2888 wrote to memory of 2544 2888 5976.tmp 44 PID 2888 wrote to memory of 2544 2888 5976.tmp 44 PID 2544 wrote to memory of 2668 2544 5A50.tmp 45 PID 2544 wrote to memory of 2668 2544 5A50.tmp 45 PID 2544 wrote to memory of 2668 2544 5A50.tmp 45 PID 2544 wrote to memory of 2668 2544 5A50.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_8026f7616083c3a549aba37e1c859d84_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\5254.tmp"C:\Users\Admin\AppData\Local\Temp\5254.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\56E6.tmp"C:\Users\Admin\AppData\Local\Temp\56E6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5783.tmp"C:\Users\Admin\AppData\Local\Temp\5783.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\581F.tmp"C:\Users\Admin\AppData\Local\Temp\581F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\5976.tmp"C:\Users\Admin\AppData\Local\Temp\5976.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5C43.tmp"C:\Users\Admin\AppData\Local\Temp\5C43.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"C:\Users\Admin\AppData\Local\Temp\5CEF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\5F21.tmp"C:\Users\Admin\AppData\Local\Temp\5F21.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\6068.tmp"C:\Users\Admin\AppData\Local\Temp\6068.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\7658.tmp"C:\Users\Admin\AppData\Local\Temp\7658.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"C:\Users\Admin\AppData\Local\Temp\7ABB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"65⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7B96.tmp"C:\Users\Admin\AppData\Local\Temp\7B96.tmp"66⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"C:\Users\Admin\AppData\Local\Temp\7BF3.tmp"67⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"68⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"69⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"70⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"C:\Users\Admin\AppData\Local\Temp\7DD7.tmp"71⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"72⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"73⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"74⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"75⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"76⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"77⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"78⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"79⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"80⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"81⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"82⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"83⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"84⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"85⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"86⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"87⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"88⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"89⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"90⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"91⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"92⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"93⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"94⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"95⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"96⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"97⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"98⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"99⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"100⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\8D51.tmp"C:\Users\Admin\AppData\Local\Temp\8D51.tmp"101⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"102⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"103⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"104⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"105⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"106⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"107⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"108⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"109⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"110⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"111⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"112⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"113⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"114⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"115⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"116⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"117⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"118⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"119⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"120⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"121⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-