Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 16:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe
-
Size
488KB
-
MD5
6045f04efe0696fca27a601cd2b962af
-
SHA1
f51da1e0d8fd0ce5709b60fe9455c081ebac513f
-
SHA256
b5d9ab95b2890bed0b8c6b205fe9005115fc1cafdedd9b537fb19e434a98a098
-
SHA512
c6f70b849573ca61369f097273b7dc202d19cfeb3be4e88a6ad3f27acb8e8801c139557a36493f3b68600003eb7538c7e16467e59b94867cefe811d069b3f862
-
SSDEEP
12288:/U5rCOTeiDY1+ojaufwooivmbzWlsuv1NZ:/UQOJDY1+0oivmbilttN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1460 3F80.tmp 2544 401C.tmp 2664 41C1.tmp 2560 42CA.tmp 2584 43C4.tmp 2728 449E.tmp 2864 455A.tmp 2564 4624.tmp 2624 46E0.tmp 2528 479B.tmp 2128 4875.tmp 1904 49AD.tmp 336 4AA7.tmp 2820 4B72.tmp 804 4C4C.tmp 2880 4D26.tmp 1676 4E10.tmp 1892 4ECC.tmp 756 4FC5.tmp 2436 5283.tmp 2696 53BB.tmp 612 54D4.tmp 1208 5580.tmp 1688 560C.tmp 1636 5698.tmp 1772 5725.tmp 1316 57B1.tmp 2132 582E.tmp 2056 58AB.tmp 2784 5947.tmp 2016 59A4.tmp 1712 5A21.tmp 2632 5AAE.tmp 1468 5B4A.tmp 2352 5BC6.tmp 3040 5C53.tmp 848 5CD0.tmp 1288 5D6C.tmp 708 5DE8.tmp 1564 5E56.tmp 2044 5ED2.tmp 1260 5F4F.tmp 372 5FAD.tmp 1944 6039.tmp 904 60A6.tmp 700 6142.tmp 1768 61CF.tmp 2960 623C.tmp 2252 62B9.tmp 1528 6336.tmp 1700 6393.tmp 2040 6410.tmp 3036 647D.tmp 2148 64CB.tmp 1608 6539.tmp 2180 65A6.tmp 2896 6613.tmp 2656 6690.tmp 2688 6864.tmp 2316 68E1.tmp 2576 695D.tmp 2560 69EA.tmp 2716 6A67.tmp 2476 6AE3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2160 2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe 1460 3F80.tmp 2544 401C.tmp 2664 41C1.tmp 2560 42CA.tmp 2584 43C4.tmp 2728 449E.tmp 2864 455A.tmp 2564 4624.tmp 2624 46E0.tmp 2528 479B.tmp 2128 4875.tmp 1904 49AD.tmp 336 4AA7.tmp 2820 4B72.tmp 804 4C4C.tmp 2880 4D26.tmp 1676 4E10.tmp 1892 4ECC.tmp 756 4FC5.tmp 2436 5283.tmp 2696 53BB.tmp 612 54D4.tmp 1208 5580.tmp 1688 560C.tmp 1636 5698.tmp 1772 5725.tmp 1316 57B1.tmp 2132 582E.tmp 2056 58AB.tmp 2784 5947.tmp 2016 59A4.tmp 1712 5A21.tmp 2632 5AAE.tmp 1468 5B4A.tmp 2352 5BC6.tmp 3040 5C53.tmp 848 5CD0.tmp 1288 5D6C.tmp 708 5DE8.tmp 1564 5E56.tmp 2044 5ED2.tmp 1260 5F4F.tmp 372 5FAD.tmp 1944 6039.tmp 904 60A6.tmp 700 6142.tmp 1768 61CF.tmp 2960 623C.tmp 2252 62B9.tmp 1528 6336.tmp 1700 6393.tmp 2040 6410.tmp 3036 647D.tmp 2148 64CB.tmp 1608 6539.tmp 2180 65A6.tmp 2896 6613.tmp 2656 6690.tmp 2688 6864.tmp 2316 68E1.tmp 2576 695D.tmp 2560 69EA.tmp 2716 6A67.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1460 2160 2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe 28 PID 2160 wrote to memory of 1460 2160 2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe 28 PID 2160 wrote to memory of 1460 2160 2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe 28 PID 2160 wrote to memory of 1460 2160 2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe 28 PID 1460 wrote to memory of 2544 1460 3F80.tmp 29 PID 1460 wrote to memory of 2544 1460 3F80.tmp 29 PID 1460 wrote to memory of 2544 1460 3F80.tmp 29 PID 1460 wrote to memory of 2544 1460 3F80.tmp 29 PID 2544 wrote to memory of 2664 2544 401C.tmp 30 PID 2544 wrote to memory of 2664 2544 401C.tmp 30 PID 2544 wrote to memory of 2664 2544 401C.tmp 30 PID 2544 wrote to memory of 2664 2544 401C.tmp 30 PID 2664 wrote to memory of 2560 2664 41C1.tmp 31 PID 2664 wrote to memory of 2560 2664 41C1.tmp 31 PID 2664 wrote to memory of 2560 2664 41C1.tmp 31 PID 2664 wrote to memory of 2560 2664 41C1.tmp 31 PID 2560 wrote to memory of 2584 2560 42CA.tmp 32 PID 2560 wrote to memory of 2584 2560 42CA.tmp 32 PID 2560 wrote to memory of 2584 2560 42CA.tmp 32 PID 2560 wrote to memory of 2584 2560 42CA.tmp 32 PID 2584 wrote to memory of 2728 2584 43C4.tmp 33 PID 2584 wrote to memory of 2728 2584 43C4.tmp 33 PID 2584 wrote to memory of 2728 2584 43C4.tmp 33 PID 2584 wrote to memory of 2728 2584 43C4.tmp 33 PID 2728 wrote to memory of 2864 2728 449E.tmp 34 PID 2728 wrote to memory of 2864 2728 449E.tmp 34 PID 2728 wrote to memory of 2864 2728 449E.tmp 34 PID 2728 wrote to memory of 2864 2728 449E.tmp 34 PID 2864 wrote to memory of 2564 2864 455A.tmp 35 PID 2864 wrote to memory of 2564 2864 455A.tmp 35 PID 2864 wrote to memory of 2564 2864 455A.tmp 35 PID 2864 wrote to memory of 2564 2864 455A.tmp 35 PID 2564 wrote to memory of 2624 2564 4624.tmp 36 PID 2564 wrote to memory of 2624 2564 4624.tmp 36 PID 2564 wrote to memory of 2624 2564 4624.tmp 36 PID 2564 wrote to memory of 2624 2564 4624.tmp 36 PID 2624 wrote to memory of 2528 2624 46E0.tmp 37 PID 2624 wrote to memory of 2528 2624 46E0.tmp 37 PID 2624 wrote to memory of 2528 2624 46E0.tmp 37 PID 2624 wrote to memory of 2528 2624 46E0.tmp 37 PID 2528 wrote to memory of 2128 2528 479B.tmp 38 PID 2528 wrote to memory of 2128 2528 479B.tmp 38 PID 2528 wrote to memory of 2128 2528 479B.tmp 38 PID 2528 wrote to memory of 2128 2528 479B.tmp 38 PID 2128 wrote to memory of 1904 2128 4875.tmp 39 PID 2128 wrote to memory of 1904 2128 4875.tmp 39 PID 2128 wrote to memory of 1904 2128 4875.tmp 39 PID 2128 wrote to memory of 1904 2128 4875.tmp 39 PID 1904 wrote to memory of 336 1904 49AD.tmp 40 PID 1904 wrote to memory of 336 1904 49AD.tmp 40 PID 1904 wrote to memory of 336 1904 49AD.tmp 40 PID 1904 wrote to memory of 336 1904 49AD.tmp 40 PID 336 wrote to memory of 2820 336 4AA7.tmp 41 PID 336 wrote to memory of 2820 336 4AA7.tmp 41 PID 336 wrote to memory of 2820 336 4AA7.tmp 41 PID 336 wrote to memory of 2820 336 4AA7.tmp 41 PID 2820 wrote to memory of 804 2820 4B72.tmp 42 PID 2820 wrote to memory of 804 2820 4B72.tmp 42 PID 2820 wrote to memory of 804 2820 4B72.tmp 42 PID 2820 wrote to memory of 804 2820 4B72.tmp 42 PID 804 wrote to memory of 2880 804 4C4C.tmp 43 PID 804 wrote to memory of 2880 804 4C4C.tmp 43 PID 804 wrote to memory of 2880 804 4C4C.tmp 43 PID 804 wrote to memory of 2880 804 4C4C.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-04_6045f04efe0696fca27a601cd2b962af_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\41C1.tmp"C:\Users\Admin\AppData\Local\Temp\41C1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\42CA.tmp"C:\Users\Admin\AppData\Local\Temp\42CA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\43C4.tmp"C:\Users\Admin\AppData\Local\Temp\43C4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\449E.tmp"C:\Users\Admin\AppData\Local\Temp\449E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\455A.tmp"C:\Users\Admin\AppData\Local\Temp\455A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4875.tmp"C:\Users\Admin\AppData\Local\Temp\4875.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"C:\Users\Admin\AppData\Local\Temp\4C4C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"C:\Users\Admin\AppData\Local\Temp\4FC5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5725.tmp"C:\Users\Admin\AppData\Local\Temp\5725.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\5947.tmp"C:\Users\Admin\AppData\Local\Temp\5947.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"C:\Users\Admin\AppData\Local\Temp\5F4F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:904 -
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6336.tmp"C:\Users\Admin\AppData\Local\Temp\6336.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\6393.tmp"C:\Users\Admin\AppData\Local\Temp\6393.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"65⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"66⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"68⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"C:\Users\Admin\AppData\Local\Temp\6CF6.tmp"69⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"70⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"C:\Users\Admin\AppData\Local\Temp\6DE0.tmp"71⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"72⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"C:\Users\Admin\AppData\Local\Temp\6ED9.tmp"73⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6F47.tmp"C:\Users\Admin\AppData\Local\Temp\6F47.tmp"74⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"75⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"76⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"77⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"78⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"79⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"80⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"81⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"82⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"83⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"84⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"85⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"87⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"88⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"89⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"91⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"92⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"93⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"94⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\78E7.tmp"C:\Users\Admin\AppData\Local\Temp\78E7.tmp"95⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"96⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"97⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"98⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"99⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"100⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"101⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"102⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"103⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"104⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"105⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"106⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"C:\Users\Admin\AppData\Local\Temp\7EF0.tmp"107⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"108⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"109⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"110⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"111⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"112⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"113⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"114⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"115⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\82E6.tmp"C:\Users\Admin\AppData\Local\Temp\82E6.tmp"116⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"118⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\844D.tmp"C:\Users\Admin\AppData\Local\Temp\844D.tmp"119⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"120⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"121⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"122⤵PID:1408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-