Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe
-
Size
486KB
-
MD5
36e17e904264bd8b4b21db409fab6752
-
SHA1
4b9d6484d58b8c4ee9a44ea00368f5915f0ed50e
-
SHA256
cd759306cbcbb5a6849f3fb643e6398118655ba5ec101b30a77d615b67220a7e
-
SHA512
6e3255ddd030b45bdaf3625cd314c44a348b0845d4681d48745f96f0bd7a8e6bdd9c249a8b8d8522f5d989cd4868994cbc5ce81a4b3a5dcbc781d8a3b6ae184c
-
SSDEEP
12288:/U5rCOTeiDDl2xAandMNSdhneY2+yIh2zNZ:/UQOJDDgRneSdhnajvzN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1384 3F9F.tmp 2260 405A.tmp 2708 4173.tmp 2864 424E.tmp 2756 4347.tmp 2676 4422.tmp 2584 453A.tmp 2496 4624.tmp 2576 470E.tmp 2476 47E9.tmp 2052 48C3.tmp 2472 499E.tmp 2944 4AA7.tmp 3060 4B91.tmp 1052 4C7B.tmp 1752 4D74.tmp 1376 4E5E.tmp 2156 4F1A.tmp 1904 5004.tmp 668 50EE.tmp 2816 5293.tmp 284 535E.tmp 1480 5428.tmp 1748 54B5.tmp 1732 5532.tmp 1660 55CE.tmp 1676 564A.tmp 2240 56C7.tmp 1316 5744.tmp 1720 57C1.tmp 2300 584D.tmp 2344 58DA.tmp 2444 5966.tmp 896 5A12.tmp 1592 5A8E.tmp 1928 5B1B.tmp 2080 5BA7.tmp 2372 5C24.tmp 1740 5C91.tmp 1444 5D0E.tmp 1780 5D9A.tmp 948 5E08.tmp 944 5E94.tmp 2116 5F01.tmp 1932 5F7E.tmp 2284 601A.tmp 1532 60A6.tmp 2164 6114.tmp 304 6181.tmp 2436 61EE.tmp 1400 626B.tmp 3020 62E8.tmp 2040 6364.tmp 1728 63E1.tmp 2884 646E.tmp 1212 64EB.tmp 2392 6548.tmp 1508 65C5.tmp 2840 673B.tmp 2844 6816.tmp 1620 6883.tmp 2768 68F0.tmp 2976 696D.tmp 3064 69F9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2112 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 1384 3F9F.tmp 2260 405A.tmp 2708 4173.tmp 2864 424E.tmp 2756 4347.tmp 2676 4422.tmp 2584 453A.tmp 2496 4624.tmp 2576 470E.tmp 2476 47E9.tmp 2052 48C3.tmp 2472 499E.tmp 2944 4AA7.tmp 3060 4B91.tmp 1052 4C7B.tmp 1752 4D74.tmp 1376 4E5E.tmp 2156 4F1A.tmp 1904 5004.tmp 668 50EE.tmp 2816 5293.tmp 284 535E.tmp 1480 5428.tmp 1748 54B5.tmp 1732 5532.tmp 1660 55CE.tmp 1676 564A.tmp 2240 56C7.tmp 1316 5744.tmp 1720 57C1.tmp 2300 584D.tmp 2344 58DA.tmp 2444 5966.tmp 896 5A12.tmp 1592 5A8E.tmp 1928 5B1B.tmp 2080 5BA7.tmp 2372 5C24.tmp 1740 5C91.tmp 1444 5D0E.tmp 1780 5D9A.tmp 948 5E08.tmp 944 5E94.tmp 2116 5F01.tmp 1932 5F7E.tmp 2284 601A.tmp 1532 60A6.tmp 2164 6114.tmp 304 6181.tmp 2436 61EE.tmp 1400 626B.tmp 3020 62E8.tmp 2040 6364.tmp 1728 63E1.tmp 2884 646E.tmp 1212 64EB.tmp 2392 6548.tmp 1508 65C5.tmp 2840 673B.tmp 2844 6816.tmp 1620 6883.tmp 2768 68F0.tmp 2976 696D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1384 2112 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 28 PID 2112 wrote to memory of 1384 2112 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 28 PID 2112 wrote to memory of 1384 2112 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 28 PID 2112 wrote to memory of 1384 2112 2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe 28 PID 1384 wrote to memory of 2260 1384 3F9F.tmp 29 PID 1384 wrote to memory of 2260 1384 3F9F.tmp 29 PID 1384 wrote to memory of 2260 1384 3F9F.tmp 29 PID 1384 wrote to memory of 2260 1384 3F9F.tmp 29 PID 2260 wrote to memory of 2708 2260 405A.tmp 30 PID 2260 wrote to memory of 2708 2260 405A.tmp 30 PID 2260 wrote to memory of 2708 2260 405A.tmp 30 PID 2260 wrote to memory of 2708 2260 405A.tmp 30 PID 2708 wrote to memory of 2864 2708 4173.tmp 31 PID 2708 wrote to memory of 2864 2708 4173.tmp 31 PID 2708 wrote to memory of 2864 2708 4173.tmp 31 PID 2708 wrote to memory of 2864 2708 4173.tmp 31 PID 2864 wrote to memory of 2756 2864 424E.tmp 32 PID 2864 wrote to memory of 2756 2864 424E.tmp 32 PID 2864 wrote to memory of 2756 2864 424E.tmp 32 PID 2864 wrote to memory of 2756 2864 424E.tmp 32 PID 2756 wrote to memory of 2676 2756 4347.tmp 33 PID 2756 wrote to memory of 2676 2756 4347.tmp 33 PID 2756 wrote to memory of 2676 2756 4347.tmp 33 PID 2756 wrote to memory of 2676 2756 4347.tmp 33 PID 2676 wrote to memory of 2584 2676 4422.tmp 34 PID 2676 wrote to memory of 2584 2676 4422.tmp 34 PID 2676 wrote to memory of 2584 2676 4422.tmp 34 PID 2676 wrote to memory of 2584 2676 4422.tmp 34 PID 2584 wrote to memory of 2496 2584 453A.tmp 35 PID 2584 wrote to memory of 2496 2584 453A.tmp 35 PID 2584 wrote to memory of 2496 2584 453A.tmp 35 PID 2584 wrote to memory of 2496 2584 453A.tmp 35 PID 2496 wrote to memory of 2576 2496 4624.tmp 36 PID 2496 wrote to memory of 2576 2496 4624.tmp 36 PID 2496 wrote to memory of 2576 2496 4624.tmp 36 PID 2496 wrote to memory of 2576 2496 4624.tmp 36 PID 2576 wrote to memory of 2476 2576 470E.tmp 37 PID 2576 wrote to memory of 2476 2576 470E.tmp 37 PID 2576 wrote to memory of 2476 2576 470E.tmp 37 PID 2576 wrote to memory of 2476 2576 470E.tmp 37 PID 2476 wrote to memory of 2052 2476 47E9.tmp 38 PID 2476 wrote to memory of 2052 2476 47E9.tmp 38 PID 2476 wrote to memory of 2052 2476 47E9.tmp 38 PID 2476 wrote to memory of 2052 2476 47E9.tmp 38 PID 2052 wrote to memory of 2472 2052 48C3.tmp 39 PID 2052 wrote to memory of 2472 2052 48C3.tmp 39 PID 2052 wrote to memory of 2472 2052 48C3.tmp 39 PID 2052 wrote to memory of 2472 2052 48C3.tmp 39 PID 2472 wrote to memory of 2944 2472 499E.tmp 40 PID 2472 wrote to memory of 2944 2472 499E.tmp 40 PID 2472 wrote to memory of 2944 2472 499E.tmp 40 PID 2472 wrote to memory of 2944 2472 499E.tmp 40 PID 2944 wrote to memory of 3060 2944 4AA7.tmp 41 PID 2944 wrote to memory of 3060 2944 4AA7.tmp 41 PID 2944 wrote to memory of 3060 2944 4AA7.tmp 41 PID 2944 wrote to memory of 3060 2944 4AA7.tmp 41 PID 3060 wrote to memory of 1052 3060 4B91.tmp 42 PID 3060 wrote to memory of 1052 3060 4B91.tmp 42 PID 3060 wrote to memory of 1052 3060 4B91.tmp 42 PID 3060 wrote to memory of 1052 3060 4B91.tmp 42 PID 1052 wrote to memory of 1752 1052 4C7B.tmp 43 PID 1052 wrote to memory of 1752 1052 4C7B.tmp 43 PID 1052 wrote to memory of 1752 1052 4C7B.tmp 43 PID 1052 wrote to memory of 1752 1052 4C7B.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-13_36e17e904264bd8b4b21db409fab6752_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\424E.tmp"C:\Users\Admin\AppData\Local\Temp\424E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4347.tmp"C:\Users\Admin\AppData\Local\Temp\4347.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\48C3.tmp"C:\Users\Admin\AppData\Local\Temp\48C3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\499E.tmp"C:\Users\Admin\AppData\Local\Temp\499E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"C:\Users\Admin\AppData\Local\Temp\4AA7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\55CE.tmp"C:\Users\Admin\AppData\Local\Temp\55CE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\564A.tmp"C:\Users\Admin\AppData\Local\Temp\564A.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\58DA.tmp"C:\Users\Admin\AppData\Local\Temp\58DA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"C:\Users\Admin\AppData\Local\Temp\5A8E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5C24.tmp"C:\Users\Admin\AppData\Local\Temp\5C24.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"C:\Users\Admin\AppData\Local\Temp\5D9A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6364.tmp"C:\Users\Admin\AppData\Local\Temp\6364.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\646E.tmp"C:\Users\Admin\AppData\Local\Temp\646E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\64EB.tmp"C:\Users\Admin\AppData\Local\Temp\64EB.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6883.tmp"C:\Users\Admin\AppData\Local\Temp\6883.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\68F0.tmp"C:\Users\Admin\AppData\Local\Temp\68F0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\69F9.tmp"C:\Users\Admin\AppData\Local\Temp\69F9.tmp"65⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"66⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"67⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"68⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"69⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"71⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"72⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"73⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"74⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6F66.tmp"C:\Users\Admin\AppData\Local\Temp\6F66.tmp"76⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"77⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"78⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"79⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"81⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"82⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"83⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"84⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\73C9.tmp"C:\Users\Admin\AppData\Local\Temp\73C9.tmp"85⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"86⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"87⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"88⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"89⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"90⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"91⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"92⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\7752.tmp"C:\Users\Admin\AppData\Local\Temp\7752.tmp"93⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"94⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"95⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"96⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"97⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\79C2.tmp"C:\Users\Admin\AppData\Local\Temp\79C2.tmp"98⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"C:\Users\Admin\AppData\Local\Temp\7A4E.tmp"99⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"100⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"101⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\7C80.tmp"C:\Users\Admin\AppData\Local\Temp\7C80.tmp"102⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"103⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"104⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"105⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"106⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"C:\Users\Admin\AppData\Local\Temp\7EE0.tmp"107⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"108⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"C:\Users\Admin\AppData\Local\Temp\7FDA.tmp"109⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\8057.tmp"C:\Users\Admin\AppData\Local\Temp\8057.tmp"110⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"111⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"112⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"113⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"114⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"115⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"116⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"117⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"118⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"119⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"120⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"121⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8565.tmp"C:\Users\Admin\AppData\Local\Temp\8565.tmp"122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-