Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/04/2024, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe
-
Size
487KB
-
MD5
31f781a44627331fa89ae3929b4b2fb3
-
SHA1
9fed567ca68c5a516b8393147054843e6699b0a7
-
SHA256
9e975564f992f8c5c2e741742ac1dccbc0668b196cd90f3d1f5084056266a334
-
SHA512
2500fe2eb61cb0b0dc7e53a2062c178ea71702a606f80429ceac84c6afbdf02dfdfa53a262c8e093871542ec8f2bf3ba9c8d4d46f3bd8c84e4e46b98c1cb5be4
-
SSDEEP
12288:yU5rCOTeiNAieTzjETYOAeKPz+yVG4bZ:yUQOJNAbTzjZzRzFVG4b
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3044 C6F.tmp 2748 CBD.tmp 2960 D2A.tmp 2664 D78.tmp 2800 DB7.tmp 2952 DF5.tmp 2660 E53.tmp 2488 EB0.tmp 2688 F0E.tmp 2508 F7B.tmp 2888 FC9.tmp 1672 1027.tmp 1800 1094.tmp 1644 10D2.tmp 2452 1130.tmp 1360 118E.tmp 1892 11EB.tmp 1964 1239.tmp 2216 1278.tmp 2392 12C6.tmp 2004 1314.tmp 2852 1371.tmp 1540 13BF.tmp 2968 13FE.tmp 2016 143C.tmp 2088 147A.tmp 2824 14B9.tmp 1348 1507.tmp 2656 1545.tmp 1956 1584.tmp 676 15D2.tmp 640 1620.tmp 1504 166E.tmp 1496 16BC.tmp 2552 16FA.tmp 2024 1748.tmp 2184 1786.tmp 344 17C5.tmp 2160 1813.tmp 348 1851.tmp 1572 1890.tmp 1996 18CE.tmp 748 190C.tmp 1848 194B.tmp 1040 1999.tmp 964 19D7.tmp 844 1A16.tmp 2060 1A64.tmp 2132 1AB2.tmp 1752 1AF0.tmp 600 1B3E.tmp 2104 1B7C.tmp 2900 1BCA.tmp 1324 1C18.tmp 2332 1C57.tmp 2784 1CF3.tmp 3064 1D41.tmp 2556 1D7F.tmp 2748 1DCD.tmp 2592 1E1B.tmp 2620 1E5A.tmp 2680 1E98.tmp 2800 1ED6.tmp 2700 1F15.tmp -
Loads dropped DLL 64 IoCs
pid Process 2784 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 3044 C6F.tmp 2748 CBD.tmp 2960 D2A.tmp 2664 D78.tmp 2800 DB7.tmp 2952 DF5.tmp 2660 E53.tmp 2488 EB0.tmp 2688 F0E.tmp 2508 F7B.tmp 2888 FC9.tmp 1672 1027.tmp 1800 1094.tmp 1644 10D2.tmp 2452 1130.tmp 1360 118E.tmp 1892 11EB.tmp 1964 1239.tmp 2216 1278.tmp 2392 12C6.tmp 2004 1314.tmp 2852 1371.tmp 1540 13BF.tmp 2968 13FE.tmp 2016 143C.tmp 2088 147A.tmp 2824 14B9.tmp 1348 1507.tmp 2656 1545.tmp 1956 1584.tmp 676 15D2.tmp 640 1620.tmp 1504 166E.tmp 1496 16BC.tmp 2552 16FA.tmp 2024 1748.tmp 2184 1786.tmp 344 17C5.tmp 2160 1813.tmp 348 1851.tmp 1572 1890.tmp 1996 18CE.tmp 748 190C.tmp 1848 194B.tmp 1040 1999.tmp 964 19D7.tmp 844 1A16.tmp 2060 1A64.tmp 2132 1AB2.tmp 1752 1AF0.tmp 600 1B3E.tmp 2104 1B7C.tmp 2900 1BCA.tmp 1324 1C18.tmp 1624 1CA5.tmp 2784 1CF3.tmp 3064 1D41.tmp 2556 1D7F.tmp 2748 1DCD.tmp 2592 1E1B.tmp 2620 1E5A.tmp 2680 1E98.tmp 2800 1ED6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 3044 2784 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 28 PID 2784 wrote to memory of 3044 2784 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 28 PID 2784 wrote to memory of 3044 2784 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 28 PID 2784 wrote to memory of 3044 2784 2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe 28 PID 3044 wrote to memory of 2748 3044 C6F.tmp 29 PID 3044 wrote to memory of 2748 3044 C6F.tmp 29 PID 3044 wrote to memory of 2748 3044 C6F.tmp 29 PID 3044 wrote to memory of 2748 3044 C6F.tmp 29 PID 2748 wrote to memory of 2960 2748 CBD.tmp 30 PID 2748 wrote to memory of 2960 2748 CBD.tmp 30 PID 2748 wrote to memory of 2960 2748 CBD.tmp 30 PID 2748 wrote to memory of 2960 2748 CBD.tmp 30 PID 2960 wrote to memory of 2664 2960 D2A.tmp 31 PID 2960 wrote to memory of 2664 2960 D2A.tmp 31 PID 2960 wrote to memory of 2664 2960 D2A.tmp 31 PID 2960 wrote to memory of 2664 2960 D2A.tmp 31 PID 2664 wrote to memory of 2800 2664 D78.tmp 32 PID 2664 wrote to memory of 2800 2664 D78.tmp 32 PID 2664 wrote to memory of 2800 2664 D78.tmp 32 PID 2664 wrote to memory of 2800 2664 D78.tmp 32 PID 2800 wrote to memory of 2952 2800 DB7.tmp 33 PID 2800 wrote to memory of 2952 2800 DB7.tmp 33 PID 2800 wrote to memory of 2952 2800 DB7.tmp 33 PID 2800 wrote to memory of 2952 2800 DB7.tmp 33 PID 2952 wrote to memory of 2660 2952 DF5.tmp 34 PID 2952 wrote to memory of 2660 2952 DF5.tmp 34 PID 2952 wrote to memory of 2660 2952 DF5.tmp 34 PID 2952 wrote to memory of 2660 2952 DF5.tmp 34 PID 2660 wrote to memory of 2488 2660 E53.tmp 35 PID 2660 wrote to memory of 2488 2660 E53.tmp 35 PID 2660 wrote to memory of 2488 2660 E53.tmp 35 PID 2660 wrote to memory of 2488 2660 E53.tmp 35 PID 2488 wrote to memory of 2688 2488 EB0.tmp 36 PID 2488 wrote to memory of 2688 2488 EB0.tmp 36 PID 2488 wrote to memory of 2688 2488 EB0.tmp 36 PID 2488 wrote to memory of 2688 2488 EB0.tmp 36 PID 2688 wrote to memory of 2508 2688 F0E.tmp 37 PID 2688 wrote to memory of 2508 2688 F0E.tmp 37 PID 2688 wrote to memory of 2508 2688 F0E.tmp 37 PID 2688 wrote to memory of 2508 2688 F0E.tmp 37 PID 2508 wrote to memory of 2888 2508 F7B.tmp 38 PID 2508 wrote to memory of 2888 2508 F7B.tmp 38 PID 2508 wrote to memory of 2888 2508 F7B.tmp 38 PID 2508 wrote to memory of 2888 2508 F7B.tmp 38 PID 2888 wrote to memory of 1672 2888 FC9.tmp 39 PID 2888 wrote to memory of 1672 2888 FC9.tmp 39 PID 2888 wrote to memory of 1672 2888 FC9.tmp 39 PID 2888 wrote to memory of 1672 2888 FC9.tmp 39 PID 1672 wrote to memory of 1800 1672 1027.tmp 40 PID 1672 wrote to memory of 1800 1672 1027.tmp 40 PID 1672 wrote to memory of 1800 1672 1027.tmp 40 PID 1672 wrote to memory of 1800 1672 1027.tmp 40 PID 1800 wrote to memory of 1644 1800 1094.tmp 41 PID 1800 wrote to memory of 1644 1800 1094.tmp 41 PID 1800 wrote to memory of 1644 1800 1094.tmp 41 PID 1800 wrote to memory of 1644 1800 1094.tmp 41 PID 1644 wrote to memory of 2452 1644 10D2.tmp 42 PID 1644 wrote to memory of 2452 1644 10D2.tmp 42 PID 1644 wrote to memory of 2452 1644 10D2.tmp 42 PID 1644 wrote to memory of 2452 1644 10D2.tmp 42 PID 2452 wrote to memory of 1360 2452 1130.tmp 43 PID 2452 wrote to memory of 1360 2452 1130.tmp 43 PID 2452 wrote to memory of 1360 2452 1130.tmp 43 PID 2452 wrote to memory of 1360 2452 1130.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_31f781a44627331fa89ae3929b4b2fb3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\118E.tmp"C:\Users\Admin\AppData\Local\Temp\118E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\15D2.tmp"C:\Users\Admin\AppData\Local\Temp\15D2.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\166E.tmp"C:\Users\Admin\AppData\Local\Temp\166E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\16FA.tmp"C:\Users\Admin\AppData\Local\Temp\16FA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:348 -
C:\Users\Admin\AppData\Local\Temp\1890.tmp"C:\Users\Admin\AppData\Local\Temp\1890.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"C:\Users\Admin\AppData\Local\Temp\1B7C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"C:\Users\Admin\AppData\Local\Temp\1BCA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"56⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"57⤵
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"C:\Users\Admin\AppData\Local\Temp\1CF3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"66⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"67⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"C:\Users\Admin\AppData\Local\Temp\1FD0.tmp"68⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"69⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"70⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"72⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"73⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"75⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"76⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"77⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"78⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"79⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"80⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"81⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"82⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"83⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"84⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\24A0.tmp"C:\Users\Admin\AppData\Local\Temp\24A0.tmp"85⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"86⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"87⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"88⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"89⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"90⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"91⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"92⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"93⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"94⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"95⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"96⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"97⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"98⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"99⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"100⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"101⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\2952.tmp"C:\Users\Admin\AppData\Local\Temp\2952.tmp"102⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\2990.tmp"C:\Users\Admin\AppData\Local\Temp\2990.tmp"103⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\29CE.tmp"C:\Users\Admin\AppData\Local\Temp\29CE.tmp"104⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"105⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"106⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"C:\Users\Admin\AppData\Local\Temp\2AA9.tmp"107⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"108⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"109⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"110⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"111⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"C:\Users\Admin\AppData\Local\Temp\2C5E.tmp"113⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"114⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"115⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"116⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"117⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"118⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"119⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"120⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"121⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-