Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 08:01
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe
-
Size
486KB
-
MD5
4bb87f1ad0237042a65a5fdef378fb06
-
SHA1
c3d0d76ecb102cb244caac81742fc53b216c8f84
-
SHA256
07678ae8a973a9fa9cc6cea63a06ba7adb3b867aec4c09314071cf23ca1d4d78
-
SHA512
b1b7282c2ddd0870f5957ecf6d341822218c924e7bab68c869dfaff485f78980fb22497f67bf20cca641514fd6fea16e62edeec488aaeaf25fc0a68e95670dba
-
SSDEEP
12288:/U5rCOTeiDnAnxcQ3o+Wq4jXxjT7O2D/PeI6NZ:/UQOJDnKh3b94jXtT7O2DP/6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2136 3CB2.tmp 2792 3E0A.tmp 2684 3EC5.tmp 3044 3FAF.tmp 2440 402C.tmp 2284 40A8.tmp 2580 4125.tmp 2552 4192.tmp 2212 420F.tmp 2316 429C.tmp 1876 4386.tmp 364 4422.tmp 2756 449E.tmp 1732 452B.tmp 1240 4598.tmp 1952 4615.tmp 1936 46B1.tmp 1728 47D9.tmp 2188 4885.tmp 592 496F.tmp 628 49FB.tmp 1480 8BEB.tmp 704 6E2E.tmp 2320 4DF1.tmp 2448 8D71.tmp 856 4EEB.tmp 1080 4F68.tmp 1992 4FD5.tmp 2344 5042.tmp 2920 50AF.tmp 2460 511C.tmp 848 518A.tmp 2752 AD7E.tmp 2476 AE1A.tmp 2960 52A2.tmp 1596 5300.tmp 2040 536D.tmp 1128 53DA.tmp 304 9231.tmp 1488 928F.tmp 1296 5522.tmp 1792 CCC1.tmp 944 B174.tmp 1036 B1E1.tmp 636 CDBB.tmp 2172 B29D.tmp 1928 5792.tmp 1664 57F0.tmp 2096 583E.tmp 2072 58BA.tmp 2340 5918.tmp 2164 E8F8.tmp 2184 59E3.tmp 2424 5A50.tmp 1508 EA20.tmp 1636 D1C0.tmp 2784 9BA3.tmp 2804 5BD6.tmp 2820 5C53.tmp 2908 5CC0.tmp 2688 9CDB.tmp 2772 5D8B.tmp 2696 ECBF.tmp 2768 B970.tmp -
Loads dropped DLL 64 IoCs
pid Process 3036 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 2136 3CB2.tmp 2792 3E0A.tmp 2684 3EC5.tmp 3044 3FAF.tmp 2440 402C.tmp 2284 40A8.tmp 2580 4125.tmp 2552 4192.tmp 2212 420F.tmp 2316 429C.tmp 1876 4386.tmp 364 4422.tmp 2756 449E.tmp 1732 452B.tmp 1240 4598.tmp 1952 4615.tmp 1936 46B1.tmp 1728 47D9.tmp 2188 4885.tmp 592 496F.tmp 628 8AE1.tmp 1480 8BEB.tmp 704 6E2E.tmp 2320 4DF1.tmp 2448 8D71.tmp 856 4EEB.tmp 1080 4F68.tmp 1992 4FD5.tmp 2344 5042.tmp 2920 50AF.tmp 2460 511C.tmp 848 518A.tmp 2752 AD7E.tmp 2476 AE1A.tmp 2960 52A2.tmp 1596 5300.tmp 2040 536D.tmp 1128 53DA.tmp 304 9231.tmp 1488 928F.tmp 1296 5522.tmp 1792 CCC1.tmp 944 B174.tmp 1036 B1E1.tmp 636 CDBB.tmp 2172 B29D.tmp 1928 5792.tmp 1664 57F0.tmp 2096 583E.tmp 2072 58BA.tmp 2340 5918.tmp 2164 E8F8.tmp 2184 59E3.tmp 2424 5A50.tmp 1508 EA20.tmp 1636 D1C0.tmp 2784 9BA3.tmp 2804 5BD6.tmp 2820 5C53.tmp 2908 5CC0.tmp 2688 9CDB.tmp 2772 5D8B.tmp 2696 6C4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2136 3036 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 28 PID 3036 wrote to memory of 2136 3036 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 28 PID 3036 wrote to memory of 2136 3036 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 28 PID 3036 wrote to memory of 2136 3036 2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe 28 PID 2136 wrote to memory of 2792 2136 3CB2.tmp 29 PID 2136 wrote to memory of 2792 2136 3CB2.tmp 29 PID 2136 wrote to memory of 2792 2136 3CB2.tmp 29 PID 2136 wrote to memory of 2792 2136 3CB2.tmp 29 PID 2792 wrote to memory of 2684 2792 3E0A.tmp 30 PID 2792 wrote to memory of 2684 2792 3E0A.tmp 30 PID 2792 wrote to memory of 2684 2792 3E0A.tmp 30 PID 2792 wrote to memory of 2684 2792 3E0A.tmp 30 PID 2684 wrote to memory of 3044 2684 3EC5.tmp 31 PID 2684 wrote to memory of 3044 2684 3EC5.tmp 31 PID 2684 wrote to memory of 3044 2684 3EC5.tmp 31 PID 2684 wrote to memory of 3044 2684 3EC5.tmp 31 PID 3044 wrote to memory of 2440 3044 3FAF.tmp 32 PID 3044 wrote to memory of 2440 3044 3FAF.tmp 32 PID 3044 wrote to memory of 2440 3044 3FAF.tmp 32 PID 3044 wrote to memory of 2440 3044 3FAF.tmp 32 PID 2440 wrote to memory of 2284 2440 402C.tmp 33 PID 2440 wrote to memory of 2284 2440 402C.tmp 33 PID 2440 wrote to memory of 2284 2440 402C.tmp 33 PID 2440 wrote to memory of 2284 2440 402C.tmp 33 PID 2284 wrote to memory of 2580 2284 40A8.tmp 34 PID 2284 wrote to memory of 2580 2284 40A8.tmp 34 PID 2284 wrote to memory of 2580 2284 40A8.tmp 34 PID 2284 wrote to memory of 2580 2284 40A8.tmp 34 PID 2580 wrote to memory of 2552 2580 4125.tmp 35 PID 2580 wrote to memory of 2552 2580 4125.tmp 35 PID 2580 wrote to memory of 2552 2580 4125.tmp 35 PID 2580 wrote to memory of 2552 2580 4125.tmp 35 PID 2552 wrote to memory of 2212 2552 4192.tmp 36 PID 2552 wrote to memory of 2212 2552 4192.tmp 36 PID 2552 wrote to memory of 2212 2552 4192.tmp 36 PID 2552 wrote to memory of 2212 2552 4192.tmp 36 PID 2212 wrote to memory of 2316 2212 420F.tmp 37 PID 2212 wrote to memory of 2316 2212 420F.tmp 37 PID 2212 wrote to memory of 2316 2212 420F.tmp 37 PID 2212 wrote to memory of 2316 2212 420F.tmp 37 PID 2316 wrote to memory of 1876 2316 429C.tmp 38 PID 2316 wrote to memory of 1876 2316 429C.tmp 38 PID 2316 wrote to memory of 1876 2316 429C.tmp 38 PID 2316 wrote to memory of 1876 2316 429C.tmp 38 PID 1876 wrote to memory of 364 1876 4386.tmp 39 PID 1876 wrote to memory of 364 1876 4386.tmp 39 PID 1876 wrote to memory of 364 1876 4386.tmp 39 PID 1876 wrote to memory of 364 1876 4386.tmp 39 PID 364 wrote to memory of 2756 364 4422.tmp 41 PID 364 wrote to memory of 2756 364 4422.tmp 41 PID 364 wrote to memory of 2756 364 4422.tmp 41 PID 364 wrote to memory of 2756 364 4422.tmp 41 PID 2756 wrote to memory of 1732 2756 449E.tmp 40 PID 2756 wrote to memory of 1732 2756 449E.tmp 40 PID 2756 wrote to memory of 1732 2756 449E.tmp 40 PID 2756 wrote to memory of 1732 2756 449E.tmp 40 PID 1732 wrote to memory of 1240 1732 452B.tmp 42 PID 1732 wrote to memory of 1240 1732 452B.tmp 42 PID 1732 wrote to memory of 1240 1732 452B.tmp 42 PID 1732 wrote to memory of 1240 1732 452B.tmp 42 PID 1240 wrote to memory of 1952 1240 4598.tmp 43 PID 1240 wrote to memory of 1952 1240 4598.tmp 43 PID 1240 wrote to memory of 1952 1240 4598.tmp 43 PID 1240 wrote to memory of 1952 1240 4598.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_4bb87f1ad0237042a65a5fdef378fb06_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"C:\Users\Admin\AppData\Local\Temp\3CB2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\429C.tmp"C:\Users\Admin\AppData\Local\Temp\429C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\4598.tmp"C:\Users\Admin\AppData\Local\Temp\4598.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4615.tmp"C:\Users\Admin\AppData\Local\Temp\4615.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\47D9.tmp"C:\Users\Admin\AppData\Local\Temp\47D9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"8⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"9⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\4D17.tmp"C:\Users\Admin\AppData\Local\Temp\4D17.tmp"10⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"12⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\511C.tmp"C:\Users\Admin\AppData\Local\Temp\511C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"20⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"21⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\52A2.tmp"C:\Users\Admin\AppData\Local\Temp\52A2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5300.tmp"C:\Users\Admin\AppData\Local\Temp\5300.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5448.tmp"C:\Users\Admin\AppData\Local\Temp\5448.tmp"26⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"27⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"29⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"30⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"31⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"32⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"33⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"39⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"42⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"43⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\5B78.tmp"C:\Users\Admin\AppData\Local\Temp\5B78.tmp"44⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"48⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"50⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"51⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"52⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\5F11.tmp"C:\Users\Admin\AppData\Local\Temp\5F11.tmp"53⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"C:\Users\Admin\AppData\Local\Temp\5F6E.tmp"54⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"C:\Users\Admin\AppData\Local\Temp\5FCC.tmp"55⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"56⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"57⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\6104.tmp"C:\Users\Admin\AppData\Local\Temp\6104.tmp"58⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"59⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"60⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"61⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"62⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"63⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"64⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"65⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"66⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"67⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"C:\Users\Admin\AppData\Local\Temp\6AB5.tmp"68⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"69⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"70⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"C:\Users\Admin\AppData\Local\Temp\6BBE.tmp"71⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"72⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"73⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"74⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6D63.tmp"C:\Users\Admin\AppData\Local\Temp\6D63.tmp"75⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"C:\Users\Admin\AppData\Local\Temp\6DD0.tmp"76⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"77⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"78⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"79⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"80⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"C:\Users\Admin\AppData\Local\Temp\6FC3.tmp"81⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"82⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"83⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"84⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"85⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"86⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"87⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"88⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\72C0.tmp"C:\Users\Admin\AppData\Local\Temp\72C0.tmp"89⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"90⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"91⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"92⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"93⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"94⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"95⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"96⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"97⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"98⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"99⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"100⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"101⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"103⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"104⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"105⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"106⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"107⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"108⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"109⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"C:\Users\Admin\AppData\Local\Temp\7ADB.tmp"110⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\7B38.tmp"C:\Users\Admin\AppData\Local\Temp\7B38.tmp"111⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"112⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"113⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"114⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"115⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"116⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"117⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"118⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"119⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"120⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"121⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-