Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 09:32
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe
-
Size
486KB
-
MD5
751baccf0f3b8889c3541aa95c467899
-
SHA1
57c6fb5ff1ee482bd4d57623475d5680f321eec9
-
SHA256
8b75c61432b538ce7e6554b5ed889d4573fecd5852a33920711ec5109a4f7151
-
SHA512
2721a08e669e2c0dd94d0968281e70d47b5ef6d8444a16e110a2a91bc0e2669ba83ef721e3e03a217f9021465937bff1636c28df7b072c82b569c6b9b5285803
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7eqCYVLg/xEaYuJEBfKFUvqzxGHNpfiScLSjj:UU5rCOTeiDtL1kPQBSKvqsf6mK2NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2468 1574.tmp 888 15E1.tmp 2528 164E.tmp 2604 16AC.tmp 2512 170A.tmp 2664 1786.tmp 2564 17F4.tmp 2440 1851.tmp 2380 18AF.tmp 2508 190C.tmp 2084 196A.tmp 320 19C8.tmp 2452 1A25.tmp 2488 1A73.tmp 1880 1AB2.tmp 1468 1AF0.tmp 1748 1B4E.tmp 2276 1BAB.tmp 1356 1C18.tmp 860 1C76.tmp 340 1CC4.tmp 2036 1D22.tmp 2904 1D70.tmp 2804 1DAE.tmp 2868 1DEC.tmp 2244 1E2B.tmp 2196 1E69.tmp 1936 1EA8.tmp 2092 1EE6.tmp 692 1F34.tmp 600 1F72.tmp 1400 1FB1.tmp 856 1FFF.tmp 2704 203D.tmp 1216 207C.tmp 2216 20BA.tmp 3036 20F8.tmp 1128 2137.tmp 2312 2175.tmp 1864 21C3.tmp 2208 2211.tmp 1020 2250.tmp 1476 229E.tmp 1948 22DC.tmp 596 231A.tmp 1716 2359.tmp 2788 23A7.tmp 1644 23F5.tmp 1244 2433.tmp 572 2472.tmp 2264 24B0.tmp 1232 24FE.tmp 1844 253C.tmp 300 257B.tmp 1972 25B9.tmp 2572 2607.tmp 2496 2646.tmp 2984 2684.tmp 2588 26C2.tmp 2756 2701.tmp 2392 273F.tmp 1040 278D.tmp 2548 27CC.tmp 2420 280A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2184 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 2468 1574.tmp 888 15E1.tmp 2528 164E.tmp 2604 16AC.tmp 2512 170A.tmp 2664 1786.tmp 2564 17F4.tmp 2440 1851.tmp 2380 18AF.tmp 2508 190C.tmp 2084 196A.tmp 320 19C8.tmp 2452 1A25.tmp 2488 1A73.tmp 1880 1AB2.tmp 1468 1AF0.tmp 1748 1B4E.tmp 2276 1BAB.tmp 1356 1C18.tmp 860 1C76.tmp 340 1CC4.tmp 2036 1D22.tmp 2904 1D70.tmp 2804 1DAE.tmp 2868 1DEC.tmp 2244 1E2B.tmp 2196 1E69.tmp 1936 1EA8.tmp 2092 1EE6.tmp 692 1F34.tmp 600 1F72.tmp 1400 1FB1.tmp 856 1FFF.tmp 2704 203D.tmp 1216 207C.tmp 2216 20BA.tmp 3036 20F8.tmp 1128 2137.tmp 2312 2175.tmp 1864 21C3.tmp 2208 2211.tmp 1020 2250.tmp 1476 229E.tmp 1948 22DC.tmp 596 231A.tmp 1716 2359.tmp 2788 23A7.tmp 1644 23F5.tmp 1244 2433.tmp 572 2472.tmp 2264 24B0.tmp 1232 24FE.tmp 1844 253C.tmp 300 257B.tmp 1972 25B9.tmp 2572 2607.tmp 2496 2646.tmp 2984 2684.tmp 2588 26C2.tmp 2756 2701.tmp 2392 273F.tmp 1040 278D.tmp 2548 27CC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2468 2184 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 29 PID 2184 wrote to memory of 2468 2184 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 29 PID 2184 wrote to memory of 2468 2184 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 29 PID 2184 wrote to memory of 2468 2184 2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe 29 PID 2468 wrote to memory of 888 2468 1574.tmp 30 PID 2468 wrote to memory of 888 2468 1574.tmp 30 PID 2468 wrote to memory of 888 2468 1574.tmp 30 PID 2468 wrote to memory of 888 2468 1574.tmp 30 PID 888 wrote to memory of 2528 888 15E1.tmp 31 PID 888 wrote to memory of 2528 888 15E1.tmp 31 PID 888 wrote to memory of 2528 888 15E1.tmp 31 PID 888 wrote to memory of 2528 888 15E1.tmp 31 PID 2528 wrote to memory of 2604 2528 164E.tmp 32 PID 2528 wrote to memory of 2604 2528 164E.tmp 32 PID 2528 wrote to memory of 2604 2528 164E.tmp 32 PID 2528 wrote to memory of 2604 2528 164E.tmp 32 PID 2604 wrote to memory of 2512 2604 16AC.tmp 33 PID 2604 wrote to memory of 2512 2604 16AC.tmp 33 PID 2604 wrote to memory of 2512 2604 16AC.tmp 33 PID 2604 wrote to memory of 2512 2604 16AC.tmp 33 PID 2512 wrote to memory of 2664 2512 170A.tmp 34 PID 2512 wrote to memory of 2664 2512 170A.tmp 34 PID 2512 wrote to memory of 2664 2512 170A.tmp 34 PID 2512 wrote to memory of 2664 2512 170A.tmp 34 PID 2664 wrote to memory of 2564 2664 1786.tmp 35 PID 2664 wrote to memory of 2564 2664 1786.tmp 35 PID 2664 wrote to memory of 2564 2664 1786.tmp 35 PID 2664 wrote to memory of 2564 2664 1786.tmp 35 PID 2564 wrote to memory of 2440 2564 17F4.tmp 36 PID 2564 wrote to memory of 2440 2564 17F4.tmp 36 PID 2564 wrote to memory of 2440 2564 17F4.tmp 36 PID 2564 wrote to memory of 2440 2564 17F4.tmp 36 PID 2440 wrote to memory of 2380 2440 1851.tmp 37 PID 2440 wrote to memory of 2380 2440 1851.tmp 37 PID 2440 wrote to memory of 2380 2440 1851.tmp 37 PID 2440 wrote to memory of 2380 2440 1851.tmp 37 PID 2380 wrote to memory of 2508 2380 18AF.tmp 38 PID 2380 wrote to memory of 2508 2380 18AF.tmp 38 PID 2380 wrote to memory of 2508 2380 18AF.tmp 38 PID 2380 wrote to memory of 2508 2380 18AF.tmp 38 PID 2508 wrote to memory of 2084 2508 190C.tmp 39 PID 2508 wrote to memory of 2084 2508 190C.tmp 39 PID 2508 wrote to memory of 2084 2508 190C.tmp 39 PID 2508 wrote to memory of 2084 2508 190C.tmp 39 PID 2084 wrote to memory of 320 2084 196A.tmp 40 PID 2084 wrote to memory of 320 2084 196A.tmp 40 PID 2084 wrote to memory of 320 2084 196A.tmp 40 PID 2084 wrote to memory of 320 2084 196A.tmp 40 PID 320 wrote to memory of 2452 320 19C8.tmp 41 PID 320 wrote to memory of 2452 320 19C8.tmp 41 PID 320 wrote to memory of 2452 320 19C8.tmp 41 PID 320 wrote to memory of 2452 320 19C8.tmp 41 PID 2452 wrote to memory of 2488 2452 1A25.tmp 42 PID 2452 wrote to memory of 2488 2452 1A25.tmp 42 PID 2452 wrote to memory of 2488 2452 1A25.tmp 42 PID 2452 wrote to memory of 2488 2452 1A25.tmp 42 PID 2488 wrote to memory of 1880 2488 1A73.tmp 43 PID 2488 wrote to memory of 1880 2488 1A73.tmp 43 PID 2488 wrote to memory of 1880 2488 1A73.tmp 43 PID 2488 wrote to memory of 1880 2488 1A73.tmp 43 PID 1880 wrote to memory of 1468 1880 1AB2.tmp 44 PID 1880 wrote to memory of 1468 1880 1AB2.tmp 44 PID 1880 wrote to memory of 1468 1880 1AB2.tmp 44 PID 1880 wrote to memory of 1468 1880 1AB2.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_751baccf0f3b8889c3541aa95c467899_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1574.tmp"C:\Users\Admin\AppData\Local\Temp\1574.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\16AC.tmp"C:\Users\Admin\AppData\Local\Temp\16AC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\170A.tmp"C:\Users\Admin\AppData\Local\Temp\170A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"C:\Users\Admin\AppData\Local\Temp\1AF0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\2211.tmp"C:\Users\Admin\AppData\Local\Temp\2211.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\2359.tmp"C:\Users\Admin\AppData\Local\Temp\2359.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\23A7.tmp"C:\Users\Admin\AppData\Local\Temp\23A7.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\23F5.tmp"C:\Users\Admin\AppData\Local\Temp\23F5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\24B0.tmp"C:\Users\Admin\AppData\Local\Temp\24B0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"65⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"66⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"67⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"68⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"70⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"71⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"72⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"73⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"74⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"C:\Users\Admin\AppData\Local\Temp\2A8A.tmp"75⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"C:\Users\Admin\AppData\Local\Temp\2AC8.tmp"76⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"77⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2B45.tmp"C:\Users\Admin\AppData\Local\Temp\2B45.tmp"78⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"79⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"80⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"81⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"82⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"83⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"84⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"85⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2D38.tmp"C:\Users\Admin\AppData\Local\Temp\2D38.tmp"86⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"87⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"88⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"C:\Users\Admin\AppData\Local\Temp\2DF3.tmp"89⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"90⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"92⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2EED.tmp"C:\Users\Admin\AppData\Local\Temp\2EED.tmp"93⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"94⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"96⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"97⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"98⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"99⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"100⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"101⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"102⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"103⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"104⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\31DA.tmp"C:\Users\Admin\AppData\Local\Temp\31DA.tmp"105⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"106⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"107⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"108⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"109⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"110⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"111⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"112⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"113⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"114⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"115⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"116⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"117⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"118⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"119⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"120⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"121⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-