Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
-
Size
486KB
-
MD5
725ee6a8141c963987a3bcc00961318f
-
SHA1
40b647f9d203daa8dec8e5369117ae148392b19d
-
SHA256
58e7d15ea155944aaac1ede6fa909e31a3afde6ac958362a19008f6b80a7e2d6
-
SHA512
82a48ffd36556f8e5ab8a596380842bfe7bc915d35b08b3cf79ee121a74b28be6a0492ed83beb02067b6b3e2ce07daf34adbe09097e23804f2c5cceb64ed96cd
-
SSDEEP
12288:/U5rCOTeiDbm9FqeklPGdueEZxbxTqKGMrzdNZ:/UQOJDbaFoPGduegbFGmN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1976 A9B.tmp 2412 4894.tmp 2700 4911.tmp 2836 B66.tmp 2704 4D84.tmp 2960 BE3.tmp 2920 C31.tmp 2844 C6F.tmp 2560 CCD.tmp 2632 D0B.tmp 2612 D59.tmp 1464 D98.tmp 2628 5C82.tmp 2788 5CC0.tmp 2904 E62.tmp 1556 3DAC.tmp 1020 3D2F.tmp 1424 F3D.tmp 344 5E27.tmp 1324 FC9.tmp 2448 6EAB.tmp 1192 5F4F.tmp 3064 1094.tmp 2400 4FD5.tmp 3032 5004.tmp 2212 5042.tmp 2900 709E.tmp 2516 11DC.tmp 2252 121A.tmp 564 6171.tmp 592 7214.tmp 2980 12D5.tmp 1460 424E.tmp 2276 62E8.tmp 1452 1390.tmp 1996 13BF.tmp 1136 33AE.tmp 840 7407.tmp 2424 148A.tmp 688 756E.tmp 1596 74F1.tmp 280 1545.tmp 776 558F.tmp 1856 15C2.tmp 112 1600.tmp 2380 162F.tmp 576 166E.tmp 2644 16AC.tmp 1612 16EA.tmp 2100 1719.tmp 2376 675B.tmp 2464 1796.tmp 884 17D4.tmp 2260 1813.tmp 1648 787A.tmp 1992 78F7.tmp 2328 18FD.tmp 2708 193B.tmp 2872 197A.tmp 2836 B66.tmp 2204 19F6.tmp 2924 1A35.tmp 1208 1A73.tmp 2604 7AAC.tmp -
Loads dropped DLL 64 IoCs
pid Process 1992 18CE.tmp 1976 A9B.tmp 2412 4894.tmp 2700 4911.tmp 2836 B66.tmp 2704 4D84.tmp 2960 BE3.tmp 2920 7974.tmp 2844 C6F.tmp 2560 CCD.tmp 2632 D0B.tmp 2612 D59.tmp 1464 D98.tmp 2628 5C82.tmp 2788 5CC0.tmp 2904 E62.tmp 1556 3DAC.tmp 1020 3D2F.tmp 1424 F3D.tmp 344 5E27.tmp 1324 FC9.tmp 2448 6EAB.tmp 1192 5F4F.tmp 3064 1094.tmp 2400 4FD5.tmp 3032 5004.tmp 2212 5042.tmp 2900 709E.tmp 2516 11DC.tmp 2252 121A.tmp 564 6171.tmp 592 7214.tmp 2980 12D5.tmp 1460 424E.tmp 2276 62E8.tmp 1452 1390.tmp 1996 13BF.tmp 1136 33AE.tmp 840 7407.tmp 2424 148A.tmp 688 756E.tmp 1596 74F1.tmp 280 1545.tmp 776 558F.tmp 1856 15C2.tmp 112 1600.tmp 2380 162F.tmp 576 166E.tmp 2644 16AC.tmp 1612 16EA.tmp 2100 1719.tmp 2376 675B.tmp 2464 1796.tmp 884 17D4.tmp 2260 1813.tmp 1528 1890.tmp 1992 78F7.tmp 2328 18FD.tmp 2708 193B.tmp 2872 197A.tmp 2836 B66.tmp 2204 19F6.tmp 2924 1A35.tmp 1208 1A73.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1976 1992 18CE.tmp 272 PID 1992 wrote to memory of 1976 1992 18CE.tmp 272 PID 1992 wrote to memory of 1976 1992 18CE.tmp 272 PID 1992 wrote to memory of 1976 1992 18CE.tmp 272 PID 1976 wrote to memory of 2412 1976 A9B.tmp 285 PID 1976 wrote to memory of 2412 1976 A9B.tmp 285 PID 1976 wrote to memory of 2412 1976 A9B.tmp 285 PID 1976 wrote to memory of 2412 1976 A9B.tmp 285 PID 2412 wrote to memory of 2700 2412 4894.tmp 288 PID 2412 wrote to memory of 2700 2412 4894.tmp 288 PID 2412 wrote to memory of 2700 2412 4894.tmp 288 PID 2412 wrote to memory of 2700 2412 4894.tmp 288 PID 2700 wrote to memory of 2836 2700 4911.tmp 265 PID 2700 wrote to memory of 2836 2700 4911.tmp 265 PID 2700 wrote to memory of 2836 2700 4911.tmp 265 PID 2700 wrote to memory of 2836 2700 4911.tmp 265 PID 2836 wrote to memory of 2704 2836 B66.tmp 306 PID 2836 wrote to memory of 2704 2836 B66.tmp 306 PID 2836 wrote to memory of 2704 2836 B66.tmp 306 PID 2836 wrote to memory of 2704 2836 B66.tmp 306 PID 2704 wrote to memory of 2960 2704 4D84.tmp 260 PID 2704 wrote to memory of 2960 2704 4D84.tmp 260 PID 2704 wrote to memory of 2960 2704 4D84.tmp 260 PID 2704 wrote to memory of 2960 2704 4D84.tmp 260 PID 2960 wrote to memory of 2920 2960 BE3.tmp 257 PID 2960 wrote to memory of 2920 2960 BE3.tmp 257 PID 2960 wrote to memory of 2920 2960 BE3.tmp 257 PID 2960 wrote to memory of 2920 2960 BE3.tmp 257 PID 2920 wrote to memory of 2844 2920 7974.tmp 247 PID 2920 wrote to memory of 2844 2920 7974.tmp 247 PID 2920 wrote to memory of 2844 2920 7974.tmp 247 PID 2920 wrote to memory of 2844 2920 7974.tmp 247 PID 2844 wrote to memory of 2560 2844 C6F.tmp 242 PID 2844 wrote to memory of 2560 2844 C6F.tmp 242 PID 2844 wrote to memory of 2560 2844 C6F.tmp 242 PID 2844 wrote to memory of 2560 2844 C6F.tmp 242 PID 2560 wrote to memory of 2632 2560 CCD.tmp 240 PID 2560 wrote to memory of 2632 2560 CCD.tmp 240 PID 2560 wrote to memory of 2632 2560 CCD.tmp 240 PID 2560 wrote to memory of 2632 2560 CCD.tmp 240 PID 2632 wrote to memory of 2612 2632 D0B.tmp 239 PID 2632 wrote to memory of 2612 2632 D0B.tmp 239 PID 2632 wrote to memory of 2612 2632 D0B.tmp 239 PID 2632 wrote to memory of 2612 2632 D0B.tmp 239 PID 2612 wrote to memory of 1464 2612 D59.tmp 235 PID 2612 wrote to memory of 1464 2612 D59.tmp 235 PID 2612 wrote to memory of 1464 2612 D59.tmp 235 PID 2612 wrote to memory of 1464 2612 D59.tmp 235 PID 1464 wrote to memory of 2628 1464 D98.tmp 371 PID 1464 wrote to memory of 2628 1464 D98.tmp 371 PID 1464 wrote to memory of 2628 1464 D98.tmp 371 PID 1464 wrote to memory of 2628 1464 D98.tmp 371 PID 2628 wrote to memory of 2788 2628 5C82.tmp 372 PID 2628 wrote to memory of 2788 2628 5C82.tmp 372 PID 2628 wrote to memory of 2788 2628 5C82.tmp 372 PID 2628 wrote to memory of 2788 2628 5C82.tmp 372 PID 2788 wrote to memory of 2904 2788 5CC0.tmp 224 PID 2788 wrote to memory of 2904 2788 5CC0.tmp 224 PID 2788 wrote to memory of 2904 2788 5CC0.tmp 224 PID 2788 wrote to memory of 2904 2788 5CC0.tmp 224 PID 2904 wrote to memory of 1556 2904 E62.tmp 217 PID 2904 wrote to memory of 1556 2904 E62.tmp 217 PID 2904 wrote to memory of 1556 2904 E62.tmp 217 PID 2904 wrote to memory of 1556 2904 E62.tmp 217
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe"1⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"1⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\B66.tmp"C:\Users\Admin\AppData\Local\Temp\B66.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836
-
-
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"1⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"2⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"3⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"4⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"5⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"6⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\513C.tmp"C:\Users\Admin\AppData\Local\Temp\513C.tmp"7⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\517A.tmp"C:\Users\Admin\AppData\Local\Temp\517A.tmp"8⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"9⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"10⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"11⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"12⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"13⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"14⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\531F.tmp"C:\Users\Admin\AppData\Local\Temp\531F.tmp"15⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"16⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"17⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\53DA.tmp"C:\Users\Admin\AppData\Local\Temp\53DA.tmp"18⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"19⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\5457.tmp"C:\Users\Admin\AppData\Local\Temp\5457.tmp"20⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5496.tmp"C:\Users\Admin\AppData\Local\Temp\5496.tmp"21⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"22⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"23⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5551.tmp"C:\Users\Admin\AppData\Local\Temp\5551.tmp"24⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\55BE.tmp"C:\Users\Admin\AppData\Local\Temp\55BE.tmp"26⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"27⤵PID:1860
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"22⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"23⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"24⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"25⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"26⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"27⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"28⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"29⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"30⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"31⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\6799.tmp"C:\Users\Admin\AppData\Local\Temp\6799.tmp"33⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"34⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"35⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"36⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6893.tmp"C:\Users\Admin\AppData\Local\Temp\6893.tmp"37⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\68C1.tmp"C:\Users\Admin\AppData\Local\Temp\68C1.tmp"38⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"39⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"40⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"41⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\697D.tmp"C:\Users\Admin\AppData\Local\Temp\697D.tmp"42⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\69BB.tmp"C:\Users\Admin\AppData\Local\Temp\69BB.tmp"43⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"44⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"45⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6A76.tmp"C:\Users\Admin\AppData\Local\Temp\6A76.tmp"46⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"C:\Users\Admin\AppData\Local\Temp\6AA5.tmp"47⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"48⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"49⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"50⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"51⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"52⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"53⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"54⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"55⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"56⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"57⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"58⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"59⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"60⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"61⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"C:\Users\Admin\AppData\Local\Temp\6E2E.tmp"62⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"63⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"C:\Users\Admin\AppData\Local\Temp\6EE9.tmp"65⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6F27.tmp"C:\Users\Admin\AppData\Local\Temp\6F27.tmp"66⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"67⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"68⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"C:\Users\Admin\AppData\Local\Temp\6FE3.tmp"69⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7021.tmp"C:\Users\Admin\AppData\Local\Temp\7021.tmp"70⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"71⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\709E.tmp"C:\Users\Admin\AppData\Local\Temp\709E.tmp"72⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"73⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\711B.tmp"C:\Users\Admin\AppData\Local\Temp\711B.tmp"74⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"75⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"76⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"77⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"78⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\7253.tmp"C:\Users\Admin\AppData\Local\Temp\7253.tmp"79⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"80⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"81⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"82⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"83⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"84⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"85⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"86⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"87⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"88⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"89⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"90⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"91⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"92⤵
- Executes dropped EXE
- Loads dropped DLL
PID:688 -
C:\Users\Admin\AppData\Local\Temp\75AD.tmp"C:\Users\Admin\AppData\Local\Temp\75AD.tmp"93⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"94⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"95⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"96⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"97⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"98⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\7713.tmp"C:\Users\Admin\AppData\Local\Temp\7713.tmp"99⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"100⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"101⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"102⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"103⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"104⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"105⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\78B9.tmp"C:\Users\Admin\AppData\Local\Temp\78B9.tmp"106⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"107⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"108⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"109⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"110⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"111⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"112⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"113⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"114⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"115⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"116⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"117⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\7B86.tmp"C:\Users\Admin\AppData\Local\Temp\7B86.tmp"118⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"119⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"121⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"C:\Users\Admin\AppData\Local\Temp\7CAF.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-