Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe
-
Size
487KB
-
MD5
5f430ccacc73a134baaf707f477bb20f
-
SHA1
5a84d6e7bf0b7bcfc4f158473d94780ca05a0e4f
-
SHA256
a7ee425ac9c0c5f7c5c14ecdae090e875eb694744dd5bae8322ee15a5a682c9e
-
SHA512
a2dedb2de5483e8f5cfa8258c65c7cb2b268664255c66e95c1d271b17dd0d4d0cb4b2b0214a80444acb50b1e3d0d9fbda99168e90de13d8a1d2c92483bc250de
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxkvXYGu6gweC/x5xDgClK4CC/cQ5b1h3g4Zsz:yU5rCOTeiNsXYBoV9lK4J/BhnsmmbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 660 3E19.tmp 1504 3EE4.tmp 2672 400C.tmp 3044 40C8.tmp 1256 41A2.tmp 2812 425D.tmp 2584 42F9.tmp 2348 43B4.tmp 2548 447F.tmp 2620 4569.tmp 2256 4634.tmp 2528 473D.tmp 2912 4818.tmp 2992 4921.tmp 2244 4A2A.tmp 2488 4AF5.tmp 2224 4BDF.tmp 1776 4CB9.tmp 2780 4D84.tmp 520 4E4F.tmp 2980 4F0A.tmp 856 5080.tmp 576 517A.tmp 2032 5216.tmp 1644 5293.tmp 1584 5310.tmp 2144 537D.tmp 1932 5409.tmp 2516 5476.tmp 2152 54E4.tmp 2432 5560.tmp 2008 55DD.tmp 1976 564A.tmp 2044 56C7.tmp 2444 5744.tmp 480 57B1.tmp 2028 580F.tmp 1140 589B.tmp 1060 5908.tmp 1392 5985.tmp 2304 59F2.tmp 1620 5A60.tmp 1640 5ADC.tmp 1820 5B59.tmp 940 5BD6.tmp 636 5C53.tmp 2064 5CB0.tmp 1668 5D1E.tmp 2040 5D9A.tmp 2372 5E27.tmp 288 5EA4.tmp 876 5F20.tmp 756 5F9D.tmp 1600 601A.tmp 1276 6087.tmp 2236 60E5.tmp 1988 6152.tmp 2652 61BF.tmp 2648 621D.tmp 2896 629A.tmp 2668 62F7.tmp 2864 6364.tmp 2660 63F1.tmp 2156 645E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2236 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 660 3E19.tmp 1504 3EE4.tmp 2672 400C.tmp 3044 40C8.tmp 1256 41A2.tmp 2812 425D.tmp 2584 42F9.tmp 2348 43B4.tmp 2548 447F.tmp 2620 4569.tmp 2256 4634.tmp 2528 473D.tmp 2912 4818.tmp 2992 4921.tmp 2244 4A2A.tmp 2488 4AF5.tmp 2224 4BDF.tmp 1776 4CB9.tmp 2780 4D84.tmp 520 4E4F.tmp 2980 4F0A.tmp 856 5080.tmp 576 517A.tmp 2032 5216.tmp 1644 5293.tmp 1584 5310.tmp 2144 537D.tmp 1932 5409.tmp 2516 5476.tmp 2152 54E4.tmp 2432 5560.tmp 2008 55DD.tmp 1976 564A.tmp 2044 56C7.tmp 2444 5744.tmp 480 57B1.tmp 2028 580F.tmp 1140 589B.tmp 1060 5908.tmp 1392 5985.tmp 2304 59F2.tmp 1620 5A60.tmp 1640 5ADC.tmp 1820 5B59.tmp 940 5BD6.tmp 636 5C53.tmp 2064 5CB0.tmp 1668 5D1E.tmp 2040 5D9A.tmp 2372 5E27.tmp 288 5EA4.tmp 876 5F20.tmp 756 5F9D.tmp 1600 601A.tmp 1276 6087.tmp 2236 60E5.tmp 1988 6152.tmp 2652 61BF.tmp 2648 621D.tmp 2896 629A.tmp 2668 62F7.tmp 2864 6364.tmp 2660 63F1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 660 2236 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 28 PID 2236 wrote to memory of 660 2236 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 28 PID 2236 wrote to memory of 660 2236 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 28 PID 2236 wrote to memory of 660 2236 2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe 28 PID 660 wrote to memory of 1504 660 3E19.tmp 29 PID 660 wrote to memory of 1504 660 3E19.tmp 29 PID 660 wrote to memory of 1504 660 3E19.tmp 29 PID 660 wrote to memory of 1504 660 3E19.tmp 29 PID 1504 wrote to memory of 2672 1504 3EE4.tmp 30 PID 1504 wrote to memory of 2672 1504 3EE4.tmp 30 PID 1504 wrote to memory of 2672 1504 3EE4.tmp 30 PID 1504 wrote to memory of 2672 1504 3EE4.tmp 30 PID 2672 wrote to memory of 3044 2672 400C.tmp 31 PID 2672 wrote to memory of 3044 2672 400C.tmp 31 PID 2672 wrote to memory of 3044 2672 400C.tmp 31 PID 2672 wrote to memory of 3044 2672 400C.tmp 31 PID 3044 wrote to memory of 1256 3044 40C8.tmp 32 PID 3044 wrote to memory of 1256 3044 40C8.tmp 32 PID 3044 wrote to memory of 1256 3044 40C8.tmp 32 PID 3044 wrote to memory of 1256 3044 40C8.tmp 32 PID 1256 wrote to memory of 2812 1256 41A2.tmp 33 PID 1256 wrote to memory of 2812 1256 41A2.tmp 33 PID 1256 wrote to memory of 2812 1256 41A2.tmp 33 PID 1256 wrote to memory of 2812 1256 41A2.tmp 33 PID 2812 wrote to memory of 2584 2812 425D.tmp 34 PID 2812 wrote to memory of 2584 2812 425D.tmp 34 PID 2812 wrote to memory of 2584 2812 425D.tmp 34 PID 2812 wrote to memory of 2584 2812 425D.tmp 34 PID 2584 wrote to memory of 2348 2584 42F9.tmp 35 PID 2584 wrote to memory of 2348 2584 42F9.tmp 35 PID 2584 wrote to memory of 2348 2584 42F9.tmp 35 PID 2584 wrote to memory of 2348 2584 42F9.tmp 35 PID 2348 wrote to memory of 2548 2348 43B4.tmp 36 PID 2348 wrote to memory of 2548 2348 43B4.tmp 36 PID 2348 wrote to memory of 2548 2348 43B4.tmp 36 PID 2348 wrote to memory of 2548 2348 43B4.tmp 36 PID 2548 wrote to memory of 2620 2548 447F.tmp 37 PID 2548 wrote to memory of 2620 2548 447F.tmp 37 PID 2548 wrote to memory of 2620 2548 447F.tmp 37 PID 2548 wrote to memory of 2620 2548 447F.tmp 37 PID 2620 wrote to memory of 2256 2620 4569.tmp 38 PID 2620 wrote to memory of 2256 2620 4569.tmp 38 PID 2620 wrote to memory of 2256 2620 4569.tmp 38 PID 2620 wrote to memory of 2256 2620 4569.tmp 38 PID 2256 wrote to memory of 2528 2256 4634.tmp 39 PID 2256 wrote to memory of 2528 2256 4634.tmp 39 PID 2256 wrote to memory of 2528 2256 4634.tmp 39 PID 2256 wrote to memory of 2528 2256 4634.tmp 39 PID 2528 wrote to memory of 2912 2528 473D.tmp 40 PID 2528 wrote to memory of 2912 2528 473D.tmp 40 PID 2528 wrote to memory of 2912 2528 473D.tmp 40 PID 2528 wrote to memory of 2912 2528 473D.tmp 40 PID 2912 wrote to memory of 2992 2912 4818.tmp 41 PID 2912 wrote to memory of 2992 2912 4818.tmp 41 PID 2912 wrote to memory of 2992 2912 4818.tmp 41 PID 2912 wrote to memory of 2992 2912 4818.tmp 41 PID 2992 wrote to memory of 2244 2992 4921.tmp 42 PID 2992 wrote to memory of 2244 2992 4921.tmp 42 PID 2992 wrote to memory of 2244 2992 4921.tmp 42 PID 2992 wrote to memory of 2244 2992 4921.tmp 42 PID 2244 wrote to memory of 2488 2244 4A2A.tmp 43 PID 2244 wrote to memory of 2488 2244 4A2A.tmp 43 PID 2244 wrote to memory of 2488 2244 4A2A.tmp 43 PID 2244 wrote to memory of 2488 2244 4A2A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_5f430ccacc73a134baaf707f477bb20f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\400C.tmp"C:\Users\Admin\AppData\Local\Temp\400C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\42F9.tmp"C:\Users\Admin\AppData\Local\Temp\42F9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\447F.tmp"C:\Users\Admin\AppData\Local\Temp\447F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4634.tmp"C:\Users\Admin\AppData\Local\Temp\4634.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\473D.tmp"C:\Users\Admin\AppData\Local\Temp\473D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4818.tmp"C:\Users\Admin\AppData\Local\Temp\4818.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\517A.tmp"C:\Users\Admin\AppData\Local\Temp\517A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\5216.tmp"C:\Users\Admin\AppData\Local\Temp\5216.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5409.tmp"C:\Users\Admin\AppData\Local\Temp\5409.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\54E4.tmp"C:\Users\Admin\AppData\Local\Temp\54E4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\5560.tmp"C:\Users\Admin\AppData\Local\Temp\5560.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\55DD.tmp"C:\Users\Admin\AppData\Local\Temp\55DD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\59F2.tmp"C:\Users\Admin\AppData\Local\Temp\59F2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"C:\Users\Admin\AppData\Local\Temp\5ADC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:636 -
C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"C:\Users\Admin\AppData\Local\Temp\5CB0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\5F20.tmp"C:\Users\Admin\AppData\Local\Temp\5F20.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\60E5.tmp"C:\Users\Admin\AppData\Local\Temp\60E5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\6364.tmp"C:\Users\Admin\AppData\Local\Temp\6364.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"65⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"66⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"67⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"68⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"70⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"71⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\6835.tmp"C:\Users\Admin\AppData\Local\Temp\6835.tmp"72⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"73⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"74⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"75⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"76⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6A67.tmp"C:\Users\Admin\AppData\Local\Temp\6A67.tmp"77⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"78⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6B31.tmp"C:\Users\Admin\AppData\Local\Temp\6B31.tmp"79⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"80⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"C:\Users\Admin\AppData\Local\Temp\6BFC.tmp"81⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"82⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"83⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"84⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"C:\Users\Admin\AppData\Local\Temp\6DB1.tmp"85⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"86⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"C:\Users\Admin\AppData\Local\Temp\6E9B.tmp"87⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"88⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"89⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"90⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\7050.tmp"C:\Users\Admin\AppData\Local\Temp\7050.tmp"91⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"92⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"93⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"94⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"95⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"96⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"97⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"98⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"99⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"100⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"101⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"102⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"103⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"104⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"105⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"106⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"107⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"108⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"109⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"110⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"111⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"112⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"113⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"114⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"115⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"116⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"117⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"118⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"119⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"120⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"121⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"122⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-