Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 17:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe
-
Size
527KB
-
MD5
61b0acada09cb24d08cb20450dcbf6b4
-
SHA1
b093d503ca6f0d8bfa944a0a2da43a21435648cb
-
SHA256
374173b2371395fa3f1195d8975f5a1575d6be93153faa07f7b6d5526bff8269
-
SHA512
c655f685d08dba5c3cf61e25fb9b2ea19f6fe11ac91e61c8eebe325cc859f58970fb036a4239beee39c166ecfecc89d5e6503a0adf1809d968a538b9ee9ee9eb
-
SSDEEP
12288:fU5rCOTeid3HUAiLRNd1LepmtgNurk8erMODZu:fUQOJdkAi/eyKug8eQODo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2344 F058.tmp 1368 F180.tmp 1364 F23B.tmp 2076 F299.tmp 2404 12E5.tmp 2760 F3E0.tmp 2812 148A.tmp 2892 F4F9.tmp 2792 F5B4.tmp 2912 F660.tmp 2768 F70C.tmp 2832 19C8.tmp 2668 F882.tmp 2744 F90E.tmp 2712 F97C.tmp 1840 FA08.tmp 1736 FAF2.tmp 2168 FC1A.tmp 2184 FCC6.tmp 2540 FD62.tmp 1948 1FC0.tmp 2116 FF17.tmp 1752 3F.tmp 1604 FA.tmp 1028 22BD.tmp 1728 231A.tmp 2656 4135.tmp 1356 34B.tmp 3064 3B8.tmp 2000 426.tmp 268 25AA.tmp 780 52F.tmp 1184 5AC.tmp 1600 609.tmp 948 6B5.tmp 1740 722.tmp 972 2829.tmp 2588 80C.tmp 1152 8E6.tmp 1784 944.tmp 1036 9F0.tmp 308 A5D.tmp 988 B08.tmp 1292 B95.tmp 2340 C12.tmp 1800 C6F.tmp 2208 CBD.tmp 2264 D1B.tmp 2280 4B62.tmp 2308 4BCF.tmp 1812 E53.tmp 2384 50A0.tmp 1596 F5C.tmp 2352 FAA.tmp 2432 1075.tmp 1660 10D2.tmp 1692 6AA5.tmp 736 11BC.tmp 2944 121A.tmp 2224 1287.tmp 2404 12E5.tmp 2868 511C.tmp 2360 518A.tmp 2812 148A.tmp -
Loads dropped DLL 64 IoCs
pid Process 1648 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 2344 F058.tmp 1368 F180.tmp 1364 F23B.tmp 2076 F299.tmp 2404 12E5.tmp 2760 F3E0.tmp 2812 148A.tmp 2892 F4F9.tmp 2792 F5B4.tmp 2912 F660.tmp 2768 F70C.tmp 2832 19C8.tmp 2668 F882.tmp 2744 F90E.tmp 2712 F97C.tmp 1840 FA08.tmp 1736 FAF2.tmp 2168 FC1A.tmp 2184 FCC6.tmp 2540 FD62.tmp 1948 1FC0.tmp 2116 FF17.tmp 1752 3F.tmp 1604 FA.tmp 1028 22BD.tmp 1728 231A.tmp 2656 4135.tmp 1356 34B.tmp 3064 3B8.tmp 2000 426.tmp 268 25AA.tmp 780 52F.tmp 1184 5AC.tmp 1600 609.tmp 948 6B5.tmp 1740 722.tmp 972 2829.tmp 2588 80C.tmp 1152 8E6.tmp 1784 944.tmp 1036 9F0.tmp 308 A5D.tmp 988 B08.tmp 1292 B95.tmp 2340 C12.tmp 1800 C6F.tmp 2208 CBD.tmp 2264 D1B.tmp 2280 4B62.tmp 2308 4BCF.tmp 1812 E53.tmp 2384 50A0.tmp 1596 F5C.tmp 2352 FAA.tmp 2432 1075.tmp 1660 10D2.tmp 1692 6AA5.tmp 736 11BC.tmp 2944 121A.tmp 2224 1287.tmp 2404 12E5.tmp 2868 511C.tmp 2360 518A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2344 1648 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 30 PID 1648 wrote to memory of 2344 1648 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 30 PID 1648 wrote to memory of 2344 1648 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 30 PID 1648 wrote to memory of 2344 1648 61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe 30 PID 2344 wrote to memory of 1368 2344 F058.tmp 31 PID 2344 wrote to memory of 1368 2344 F058.tmp 31 PID 2344 wrote to memory of 1368 2344 F058.tmp 31 PID 2344 wrote to memory of 1368 2344 F058.tmp 31 PID 1368 wrote to memory of 1364 1368 F180.tmp 32 PID 1368 wrote to memory of 1364 1368 F180.tmp 32 PID 1368 wrote to memory of 1364 1368 F180.tmp 32 PID 1368 wrote to memory of 1364 1368 F180.tmp 32 PID 1364 wrote to memory of 2076 1364 F23B.tmp 33 PID 1364 wrote to memory of 2076 1364 F23B.tmp 33 PID 1364 wrote to memory of 2076 1364 F23B.tmp 33 PID 1364 wrote to memory of 2076 1364 F23B.tmp 33 PID 2076 wrote to memory of 2404 2076 F299.tmp 90 PID 2076 wrote to memory of 2404 2076 F299.tmp 90 PID 2076 wrote to memory of 2404 2076 F299.tmp 90 PID 2076 wrote to memory of 2404 2076 F299.tmp 90 PID 2404 wrote to memory of 2760 2404 12E5.tmp 35 PID 2404 wrote to memory of 2760 2404 12E5.tmp 35 PID 2404 wrote to memory of 2760 2404 12E5.tmp 35 PID 2404 wrote to memory of 2760 2404 12E5.tmp 35 PID 2760 wrote to memory of 2812 2760 F3E0.tmp 93 PID 2760 wrote to memory of 2812 2760 F3E0.tmp 93 PID 2760 wrote to memory of 2812 2760 F3E0.tmp 93 PID 2760 wrote to memory of 2812 2760 F3E0.tmp 93 PID 2812 wrote to memory of 2892 2812 148A.tmp 37 PID 2812 wrote to memory of 2892 2812 148A.tmp 37 PID 2812 wrote to memory of 2892 2812 148A.tmp 37 PID 2812 wrote to memory of 2892 2812 148A.tmp 37 PID 2892 wrote to memory of 2792 2892 F4F9.tmp 38 PID 2892 wrote to memory of 2792 2892 F4F9.tmp 38 PID 2892 wrote to memory of 2792 2892 F4F9.tmp 38 PID 2892 wrote to memory of 2792 2892 F4F9.tmp 38 PID 2792 wrote to memory of 2912 2792 F5B4.tmp 46 PID 2792 wrote to memory of 2912 2792 F5B4.tmp 46 PID 2792 wrote to memory of 2912 2792 F5B4.tmp 46 PID 2792 wrote to memory of 2912 2792 F5B4.tmp 46 PID 2912 wrote to memory of 2768 2912 F660.tmp 39 PID 2912 wrote to memory of 2768 2912 F660.tmp 39 PID 2912 wrote to memory of 2768 2912 F660.tmp 39 PID 2912 wrote to memory of 2768 2912 F660.tmp 39 PID 2768 wrote to memory of 2832 2768 F70C.tmp 100 PID 2768 wrote to memory of 2832 2768 F70C.tmp 100 PID 2768 wrote to memory of 2832 2768 F70C.tmp 100 PID 2768 wrote to memory of 2832 2768 F70C.tmp 100 PID 2832 wrote to memory of 2668 2832 19C8.tmp 40 PID 2832 wrote to memory of 2668 2832 19C8.tmp 40 PID 2832 wrote to memory of 2668 2832 19C8.tmp 40 PID 2832 wrote to memory of 2668 2832 19C8.tmp 40 PID 2668 wrote to memory of 2744 2668 F882.tmp 44 PID 2668 wrote to memory of 2744 2668 F882.tmp 44 PID 2668 wrote to memory of 2744 2668 F882.tmp 44 PID 2668 wrote to memory of 2744 2668 F882.tmp 44 PID 2744 wrote to memory of 2712 2744 F90E.tmp 41 PID 2744 wrote to memory of 2712 2744 F90E.tmp 41 PID 2744 wrote to memory of 2712 2744 F90E.tmp 41 PID 2744 wrote to memory of 2712 2744 F90E.tmp 41 PID 2712 wrote to memory of 1840 2712 F97C.tmp 42 PID 2712 wrote to memory of 1840 2712 F97C.tmp 42 PID 2712 wrote to memory of 1840 2712 F97C.tmp 42 PID 2712 wrote to memory of 1840 2712 F97C.tmp 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\61b0acada09cb24d08cb20450dcbf6b4_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\F058.tmp"C:\Users\Admin\AppData\Local\Temp\F058.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F180.tmp"C:\Users\Admin\AppData\Local\Temp\F180.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"6⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"8⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F70C.tmp"C:\Users\Admin\AppData\Local\Temp\F70C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"2⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\F97C.tmp"C:\Users\Admin\AppData\Local\Temp\F97C.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"2⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"6⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"7⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"8⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3B8.tmp"C:\Users\Admin\AppData\Local\Temp\3B8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4C2.tmp"C:\Users\Admin\AppData\Local\Temp\4C2.tmp"12⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"18⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\B08.tmp"C:\Users\Admin\AppData\Local\Temp\B08.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"30⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"31⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"33⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\114F.tmp"C:\Users\Admin\AppData\Local\Temp\114F.tmp"38⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:736 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1352.tmp"C:\Users\Admin\AppData\Local\Temp\1352.tmp"43⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\13CF.tmp"C:\Users\Admin\AppData\Local\Temp\13CF.tmp"44⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"46⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"47⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"48⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"49⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"50⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"51⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1A44.tmp"C:\Users\Admin\AppData\Local\Temp\1A44.tmp"53⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"C:\Users\Admin\AppData\Local\Temp\1AB2.tmp"54⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"C:\Users\Admin\AppData\Local\Temp\1B3E.tmp"55⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"56⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"57⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"58⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"59⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"C:\Users\Admin\AppData\Local\Temp\1D7F.tmp"60⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"61⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\1E88.tmp"C:\Users\Admin\AppData\Local\Temp\1E88.tmp"62⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"63⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"64⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"66⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"67⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"68⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"69⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"70⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"71⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"72⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"73⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"74⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\23D6.tmp"C:\Users\Admin\AppData\Local\Temp\23D6.tmp"75⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"76⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"77⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"78⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"79⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"80⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"81⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"82⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"83⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"84⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"86⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2913.tmp"C:\Users\Admin\AppData\Local\Temp\2913.tmp"87⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"88⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"89⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"90⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"91⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"92⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"93⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"94⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"95⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"96⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"97⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"98⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"C:\Users\Admin\AppData\Local\Temp\2FF6.tmp"99⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"100⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"101⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\312E.tmp"C:\Users\Admin\AppData\Local\Temp\312E.tmp"102⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"103⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"104⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"106⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"107⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"108⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"109⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"110⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"111⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"112⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"113⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"114⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"115⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\3756.tmp"C:\Users\Admin\AppData\Local\Temp\3756.tmp"116⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"117⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"118⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\388E.tmp"C:\Users\Admin\AppData\Local\Temp\388E.tmp"119⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"120⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3958.tmp"C:\Users\Admin\AppData\Local\Temp\3958.tmp"121⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"122⤵PID:1228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-