Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe
-
Size
488KB
-
MD5
1f781af6dc80210fcb636be26b1f21b8
-
SHA1
2b0da138881ed687246d868e60cac2519224d9b1
-
SHA256
284d1b472871cb76e9e2d01cc2f65550f475d132d7c717d148e16577159c092f
-
SHA512
32c078ccf50a4bd8f858ae9dcc09f60f9195b512ca5dfe8079475e52b34d1aa26c4bd9f7697a9f31ed1d754f8eb7982e55b8a4799e7bbb47780a4ecda95d8d3f
-
SSDEEP
12288:/U5rCOTeiDyqafPGXmlfS8Q0LMv9HLpNZ:/UQOJDyxC8QvBpN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1548 D225.tmp 3836 D31F.tmp 3376 D3AB.tmp 1960 D467.tmp 4068 D522.tmp 2840 D59F.tmp 704 D63C.tmp 3064 D6D8.tmp 2760 D764.tmp 1988 D7F1.tmp 3780 D8BC.tmp 4064 D978.tmp 1460 DA24.tmp 3012 DAB0.tmp 4112 DB4C.tmp 4916 DBC9.tmp 2400 DC66.tmp 1884 DD50.tmp 3364 DED7.tmp 1412 DF92.tmp 3480 E04E.tmp 2592 E697.tmp 5100 E762.tmp 1504 E84D.tmp 3668 E918.tmp 1984 E9A4.tmp 1352 EA41.tmp 2324 EACD.tmp 3796 EB69.tmp 520 EC15.tmp 3472 ECF0.tmp 1008 ED7D.tmp 2100 EE96.tmp 340 EF13.tmp 1728 EFAF.tmp 996 F01D.tmp 1404 F09A.tmp 4472 D1A.tmp 5068 D88.tmp 1968 E14.tmp 3256 F27E.tmp 684 F31A.tmp 4940 F397.tmp 3216 F405.tmp 3936 F482.tmp 5028 F50E.tmp 2948 F59B.tmp 252 F608.tmp 4552 F695.tmp 1908 F712.tmp 3628 F77F.tmp 3192 F7ED.tmp 2416 F86A.tmp 1556 F8C7.tmp 1764 F954.tmp 2264 F9D1.tmp 4640 FB48.tmp 2636 FBA6.tmp 3100 FC13.tmp 3776 FC80.tmp 4608 FCEE.tmp 2892 FD5B.tmp 2876 FDB9.tmp 2312 FE26.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 1548 4060 1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe 81 PID 4060 wrote to memory of 1548 4060 1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe 81 PID 4060 wrote to memory of 1548 4060 1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe 81 PID 1548 wrote to memory of 3836 1548 D225.tmp 82 PID 1548 wrote to memory of 3836 1548 D225.tmp 82 PID 1548 wrote to memory of 3836 1548 D225.tmp 82 PID 3836 wrote to memory of 3376 3836 D31F.tmp 83 PID 3836 wrote to memory of 3376 3836 D31F.tmp 83 PID 3836 wrote to memory of 3376 3836 D31F.tmp 83 PID 3376 wrote to memory of 1960 3376 D3AB.tmp 84 PID 3376 wrote to memory of 1960 3376 D3AB.tmp 84 PID 3376 wrote to memory of 1960 3376 D3AB.tmp 84 PID 1960 wrote to memory of 4068 1960 D467.tmp 85 PID 1960 wrote to memory of 4068 1960 D467.tmp 85 PID 1960 wrote to memory of 4068 1960 D467.tmp 85 PID 4068 wrote to memory of 2840 4068 D522.tmp 86 PID 4068 wrote to memory of 2840 4068 D522.tmp 86 PID 4068 wrote to memory of 2840 4068 D522.tmp 86 PID 2840 wrote to memory of 704 2840 D59F.tmp 87 PID 2840 wrote to memory of 704 2840 D59F.tmp 87 PID 2840 wrote to memory of 704 2840 D59F.tmp 87 PID 704 wrote to memory of 3064 704 D63C.tmp 88 PID 704 wrote to memory of 3064 704 D63C.tmp 88 PID 704 wrote to memory of 3064 704 D63C.tmp 88 PID 3064 wrote to memory of 2760 3064 D6D8.tmp 89 PID 3064 wrote to memory of 2760 3064 D6D8.tmp 89 PID 3064 wrote to memory of 2760 3064 D6D8.tmp 89 PID 2760 wrote to memory of 1988 2760 D764.tmp 90 PID 2760 wrote to memory of 1988 2760 D764.tmp 90 PID 2760 wrote to memory of 1988 2760 D764.tmp 90 PID 1988 wrote to memory of 3780 1988 D7F1.tmp 91 PID 1988 wrote to memory of 3780 1988 D7F1.tmp 91 PID 1988 wrote to memory of 3780 1988 D7F1.tmp 91 PID 3780 wrote to memory of 4064 3780 D8BC.tmp 92 PID 3780 wrote to memory of 4064 3780 D8BC.tmp 92 PID 3780 wrote to memory of 4064 3780 D8BC.tmp 92 PID 4064 wrote to memory of 1460 4064 D978.tmp 93 PID 4064 wrote to memory of 1460 4064 D978.tmp 93 PID 4064 wrote to memory of 1460 4064 D978.tmp 93 PID 1460 wrote to memory of 3012 1460 DA24.tmp 94 PID 1460 wrote to memory of 3012 1460 DA24.tmp 94 PID 1460 wrote to memory of 3012 1460 DA24.tmp 94 PID 3012 wrote to memory of 4112 3012 DAB0.tmp 95 PID 3012 wrote to memory of 4112 3012 DAB0.tmp 95 PID 3012 wrote to memory of 4112 3012 DAB0.tmp 95 PID 4112 wrote to memory of 4916 4112 DB4C.tmp 96 PID 4112 wrote to memory of 4916 4112 DB4C.tmp 96 PID 4112 wrote to memory of 4916 4112 DB4C.tmp 96 PID 4916 wrote to memory of 2400 4916 DBC9.tmp 97 PID 4916 wrote to memory of 2400 4916 DBC9.tmp 97 PID 4916 wrote to memory of 2400 4916 DBC9.tmp 97 PID 2400 wrote to memory of 1884 2400 DC66.tmp 98 PID 2400 wrote to memory of 1884 2400 DC66.tmp 98 PID 2400 wrote to memory of 1884 2400 DC66.tmp 98 PID 1884 wrote to memory of 3364 1884 DD50.tmp 101 PID 1884 wrote to memory of 3364 1884 DD50.tmp 101 PID 1884 wrote to memory of 3364 1884 DD50.tmp 101 PID 3364 wrote to memory of 1412 3364 DED7.tmp 102 PID 3364 wrote to memory of 1412 3364 DED7.tmp 102 PID 3364 wrote to memory of 1412 3364 DED7.tmp 102 PID 1412 wrote to memory of 3480 1412 DF92.tmp 103 PID 1412 wrote to memory of 3480 1412 DF92.tmp 103 PID 1412 wrote to memory of 3480 1412 DF92.tmp 103 PID 3480 wrote to memory of 2592 3480 E04E.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1f781af6dc80210fcb636be26b1f21b8_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\D31F.tmp"C:\Users\Admin\AppData\Local\Temp\D31F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\D764.tmp"C:\Users\Admin\AppData\Local\Temp\D764.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"C:\Users\Admin\AppData\Local\Temp\D7F1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\E697.tmp"C:\Users\Admin\AppData\Local\Temp\E697.tmp"23⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"24⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"25⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"26⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"27⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"28⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"29⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"30⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"31⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"32⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"33⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"34⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"35⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"36⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"37⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"38⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"39⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"40⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"41⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"42⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"43⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"44⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"45⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"46⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"47⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"48⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"49⤵
- Executes dropped EXE
PID:252 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"50⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"51⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"52⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"53⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"54⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"55⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"56⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"57⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"58⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"59⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"60⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"61⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"62⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"63⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"64⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"65⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"66⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"67⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"C:\Users\Admin\AppData\Local\Temp\FF5F.tmp"68⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"69⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"70⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"71⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"72⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"73⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"74⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"75⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"76⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"77⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"78⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"80⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"81⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"82⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"83⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"84⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"85⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"86⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"87⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"88⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"89⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"90⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"91⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"92⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"93⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"95⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"96⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"97⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"98⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"99⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E14.tmp"C:\Users\Admin\AppData\Local\Temp\E14.tmp"100⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"101⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"102⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"103⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"104⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"105⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"106⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"107⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"108⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"109⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"110⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"111⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\14AC.tmp"C:\Users\Admin\AppData\Local\Temp\14AC.tmp"112⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"113⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"114⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\1642.tmp"C:\Users\Admin\AppData\Local\Temp\1642.tmp"115⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"116⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"117⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"118⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"119⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"120⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"122⤵PID:3692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-