Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 04:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe
-
Size
527KB
-
MD5
21c929ce4e7480039bc7b01ac1f1d4aa
-
SHA1
2c0e132b415c4b1d7587564949f3159408cac674
-
SHA256
4c5130d878a38a6d58e37c855cf52cb36ff372b4e6b29afc9e3547d48682de43
-
SHA512
371240ee6c6879b1f14e09710296674b33f1b2f0a2df4e1dfc6d6320f7710fbe95d20ffdb23db2c1f268447172096bc040a6b294be20bf98c3ec4b6d7432ceab
-
SSDEEP
12288:fU5rCOTeid/zxAYivXjAH58B8EnlEP1foMrDmDZu:fUQOJd/qYivzAH5836P1fFrDmDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3016 7BD4.tmp 1296 7CAF.tmp 2716 7D2B.tmp 2544 7DB8.tmp 2768 7E44.tmp 2456 7F2E.tmp 2972 7FCA.tmp 2532 80F3.tmp 2464 818F.tmp 2940 82A7.tmp 524 8382.tmp 2404 848B.tmp 240 8537.tmp 584 8630.tmp 1772 871A.tmp 2828 8823.tmp 2460 88DF.tmp 2516 89B9.tmp 1428 8AC2.tmp 2628 8BBC.tmp 1832 8C58.tmp 2008 8D71.tmp 2660 8FB2.tmp 2028 905D.tmp 1620 90DA.tmp 1612 9157.tmp 1768 91E3.tmp 1932 9270.tmp 2260 92FC.tmp 768 9389.tmp 2280 9434.tmp 1644 94C1.tmp 2880 954D.tmp 2292 95CA.tmp 992 9637.tmp 1980 96C3.tmp 964 9740.tmp 1052 97CD.tmp 1504 983A.tmp 1748 98C6.tmp 1584 9933.tmp 984 99CF.tmp 1276 9A2D.tmp 852 9A8B.tmp 320 9B07.tmp 2208 9B84.tmp 2844 9BF1.tmp 1684 9C5F.tmp 2908 9CDB.tmp 1736 9D68.tmp 2016 9DE5.tmp 3052 9E61.tmp 2248 9EDE.tmp 1876 9F4B.tmp 1560 9FB9.tmp 1672 A026.tmp 3056 A083.tmp 2708 A0E1.tmp 1296 A15E.tmp 2712 A1DB.tmp 2696 A257.tmp 2764 A2D4.tmp 2620 A370.tmp 1984 A515.tmp -
Loads dropped DLL 64 IoCs
pid Process 1760 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 3016 7BD4.tmp 1296 7CAF.tmp 2716 7D2B.tmp 2544 7DB8.tmp 2768 7E44.tmp 2456 7F2E.tmp 2972 7FCA.tmp 2532 80F3.tmp 2464 818F.tmp 2940 82A7.tmp 524 8382.tmp 2404 848B.tmp 240 8537.tmp 584 8630.tmp 1772 871A.tmp 2828 8823.tmp 2460 88DF.tmp 2516 89B9.tmp 1428 8AC2.tmp 2628 8BBC.tmp 1832 8C58.tmp 2008 8D71.tmp 2660 8FB2.tmp 2028 905D.tmp 1620 90DA.tmp 1612 9157.tmp 1768 91E3.tmp 1932 9270.tmp 2260 92FC.tmp 768 9389.tmp 2280 9434.tmp 1644 94C1.tmp 2880 954D.tmp 2292 95CA.tmp 992 9637.tmp 1980 96C3.tmp 964 9740.tmp 1052 97CD.tmp 1504 983A.tmp 1748 98C6.tmp 1584 9933.tmp 984 99CF.tmp 1276 9A2D.tmp 852 9A8B.tmp 320 9B07.tmp 2208 9B84.tmp 2844 9BF1.tmp 1684 9C5F.tmp 2908 9CDB.tmp 1736 9D68.tmp 2016 9DE5.tmp 3052 9E61.tmp 2248 9EDE.tmp 1876 9F4B.tmp 1560 9FB9.tmp 1672 A026.tmp 3056 A083.tmp 2708 A0E1.tmp 1296 A15E.tmp 2712 A1DB.tmp 2696 A257.tmp 2764 A2D4.tmp 2620 A370.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3016 1760 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 28 PID 1760 wrote to memory of 3016 1760 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 28 PID 1760 wrote to memory of 3016 1760 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 28 PID 1760 wrote to memory of 3016 1760 2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe 28 PID 3016 wrote to memory of 1296 3016 7BD4.tmp 29 PID 3016 wrote to memory of 1296 3016 7BD4.tmp 29 PID 3016 wrote to memory of 1296 3016 7BD4.tmp 29 PID 3016 wrote to memory of 1296 3016 7BD4.tmp 29 PID 1296 wrote to memory of 2716 1296 7CAF.tmp 30 PID 1296 wrote to memory of 2716 1296 7CAF.tmp 30 PID 1296 wrote to memory of 2716 1296 7CAF.tmp 30 PID 1296 wrote to memory of 2716 1296 7CAF.tmp 30 PID 2716 wrote to memory of 2544 2716 7D2B.tmp 31 PID 2716 wrote to memory of 2544 2716 7D2B.tmp 31 PID 2716 wrote to memory of 2544 2716 7D2B.tmp 31 PID 2716 wrote to memory of 2544 2716 7D2B.tmp 31 PID 2544 wrote to memory of 2768 2544 7DB8.tmp 32 PID 2544 wrote to memory of 2768 2544 7DB8.tmp 32 PID 2544 wrote to memory of 2768 2544 7DB8.tmp 32 PID 2544 wrote to memory of 2768 2544 7DB8.tmp 32 PID 2768 wrote to memory of 2456 2768 7E44.tmp 33 PID 2768 wrote to memory of 2456 2768 7E44.tmp 33 PID 2768 wrote to memory of 2456 2768 7E44.tmp 33 PID 2768 wrote to memory of 2456 2768 7E44.tmp 33 PID 2456 wrote to memory of 2972 2456 7F2E.tmp 34 PID 2456 wrote to memory of 2972 2456 7F2E.tmp 34 PID 2456 wrote to memory of 2972 2456 7F2E.tmp 34 PID 2456 wrote to memory of 2972 2456 7F2E.tmp 34 PID 2972 wrote to memory of 2532 2972 7FCA.tmp 35 PID 2972 wrote to memory of 2532 2972 7FCA.tmp 35 PID 2972 wrote to memory of 2532 2972 7FCA.tmp 35 PID 2972 wrote to memory of 2532 2972 7FCA.tmp 35 PID 2532 wrote to memory of 2464 2532 80F3.tmp 36 PID 2532 wrote to memory of 2464 2532 80F3.tmp 36 PID 2532 wrote to memory of 2464 2532 80F3.tmp 36 PID 2532 wrote to memory of 2464 2532 80F3.tmp 36 PID 2464 wrote to memory of 2940 2464 818F.tmp 37 PID 2464 wrote to memory of 2940 2464 818F.tmp 37 PID 2464 wrote to memory of 2940 2464 818F.tmp 37 PID 2464 wrote to memory of 2940 2464 818F.tmp 37 PID 2940 wrote to memory of 524 2940 82A7.tmp 38 PID 2940 wrote to memory of 524 2940 82A7.tmp 38 PID 2940 wrote to memory of 524 2940 82A7.tmp 38 PID 2940 wrote to memory of 524 2940 82A7.tmp 38 PID 524 wrote to memory of 2404 524 8382.tmp 39 PID 524 wrote to memory of 2404 524 8382.tmp 39 PID 524 wrote to memory of 2404 524 8382.tmp 39 PID 524 wrote to memory of 2404 524 8382.tmp 39 PID 2404 wrote to memory of 240 2404 848B.tmp 40 PID 2404 wrote to memory of 240 2404 848B.tmp 40 PID 2404 wrote to memory of 240 2404 848B.tmp 40 PID 2404 wrote to memory of 240 2404 848B.tmp 40 PID 240 wrote to memory of 584 240 8537.tmp 41 PID 240 wrote to memory of 584 240 8537.tmp 41 PID 240 wrote to memory of 584 240 8537.tmp 41 PID 240 wrote to memory of 584 240 8537.tmp 41 PID 584 wrote to memory of 1772 584 8630.tmp 42 PID 584 wrote to memory of 1772 584 8630.tmp 42 PID 584 wrote to memory of 1772 584 8630.tmp 42 PID 584 wrote to memory of 1772 584 8630.tmp 42 PID 1772 wrote to memory of 2828 1772 871A.tmp 43 PID 1772 wrote to memory of 2828 1772 871A.tmp 43 PID 1772 wrote to memory of 2828 1772 871A.tmp 43 PID 1772 wrote to memory of 2828 1772 871A.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_21c929ce4e7480039bc7b01ac1f1d4aa_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\80F3.tmp"C:\Users\Admin\AppData\Local\Temp\80F3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Users\Admin\AppData\Local\Temp\848B.tmp"C:\Users\Admin\AppData\Local\Temp\848B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\871A.tmp"C:\Users\Admin\AppData\Local\Temp\871A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\9389.tmp"C:\Users\Admin\AppData\Local\Temp\9389.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\954D.tmp"C:\Users\Admin\AppData\Local\Temp\954D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\9740.tmp"C:\Users\Admin\AppData\Local\Temp\9740.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"C:\Users\Admin\AppData\Local\Temp\9DE5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"C:\Users\Admin\AppData\Local\Temp\9F4B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"65⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"66⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"67⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"68⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"69⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"70⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"71⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"72⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"73⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"74⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"75⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"76⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"77⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"78⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"79⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"80⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"81⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"82⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"83⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"84⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"85⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"86⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"88⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"89⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"90⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"91⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"92⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"93⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"94⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"95⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"96⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"C:\Users\Admin\AppData\Local\Temp\B4CE.tmp"97⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"98⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"99⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"100⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"101⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"103⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"C:\Users\Admin\AppData\Local\Temp\B7CB.tmp"104⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"105⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"106⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"107⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"108⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"C:\Users\Admin\AppData\Local\Temp\BAC7.tmp"109⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"110⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"112⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"113⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"114⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"115⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"116⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"117⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"118⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"119⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"120⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"121⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"122⤵PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-