Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe
-
Size
486KB
-
MD5
792890b406d8f814a027a7cd3b39d2dc
-
SHA1
7c30ae570bbf9cdcc7c5df4705a8b06e349c5aba
-
SHA256
56cf9f8093e122b62b96f85004c8b1b2dca86b01d5efaed89f576e044ed26ec0
-
SHA512
a10ac2e14290b3b4b61645143b6d15422a3301ec1d9ef48255c2f62739e23b84f07cd14eedc110cf09ee7c270e8f3f48e92fcf7e80fcccbd7241cf8f016acfb6
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7rGxtt8NDj3LjkeYghKw30anHBclHSDOnG4zi:UU5rCOTeiDeMBjxYByUMwhSEEstSNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 860 87CD.tmp 1224 63FA.tmp 4804 6486.tmp 4448 6522.tmp 1180 65CE.tmp 3696 663C.tmp 4492 66A9.tmp 5016 6707.tmp 4076 274A.tmp 1608 4D8E.tmp 1940 150A.tmp 4892 691A.tmp 4848 584C.tmp 3520 69F5.tmp 2928 E34B.tmp 3432 C975.tmp 4160 6B9B.tmp 4036 E530.tmp 4832 9069.tmp 3344 6B57.tmp 3924 6107.tmp 440 B2A1.tmp 2332 D56C.tmp 4200 12C8.tmp 3040 B234.tmp 2356 6FF0.tmp 5068 946B.tmp 3928 1940.tmp 1124 4253.tmp 228 72BF.tmp 5092 732C.tmp 988 738A.tmp 4424 3498.tmp 4952 E4DD.tmp 1660 7520.tmp 860 1D04.tmp 3020 3582.tmp 2652 7688.tmp 4216 76E5.tmp 1696 3697.tmp 1972 2565.tmp 1180 65CE.tmp 2396 7956.tmp 1316 2EF6.tmp 8 7A41.tmp 4076 274A.tmp 1608 4D8E.tmp 4228 4B1D.tmp 1260 B977.tmp 3988 DF10.tmp 3108 7D5E.tmp 5056 3BCC.tmp 2504 7EE4.tmp 2596 DDA9.tmp 1772 E59D.tmp 548 3A21.tmp 2196 C479.tmp 3552 43C6.tmp 572 D83.tmp 4948 6344.tmp 4720 15C0.tmp 4876 2541.tmp 3740 8388.tmp 3776 4B28.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 860 4944 2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe 112 PID 4944 wrote to memory of 860 4944 2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe 112 PID 4944 wrote to memory of 860 4944 2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe 112 PID 860 wrote to memory of 1224 860 87CD.tmp 92 PID 860 wrote to memory of 1224 860 87CD.tmp 92 PID 860 wrote to memory of 1224 860 87CD.tmp 92 PID 1224 wrote to memory of 4804 1224 63FA.tmp 32 PID 1224 wrote to memory of 4804 1224 63FA.tmp 32 PID 1224 wrote to memory of 4804 1224 63FA.tmp 32 PID 4804 wrote to memory of 4448 4804 6486.tmp 33 PID 4804 wrote to memory of 4448 4804 6486.tmp 33 PID 4804 wrote to memory of 4448 4804 6486.tmp 33 PID 4448 wrote to memory of 1180 4448 6522.tmp 84 PID 4448 wrote to memory of 1180 4448 6522.tmp 84 PID 4448 wrote to memory of 1180 4448 6522.tmp 84 PID 1180 wrote to memory of 3696 1180 65CE.tmp 35 PID 1180 wrote to memory of 3696 1180 65CE.tmp 35 PID 1180 wrote to memory of 3696 1180 65CE.tmp 35 PID 3696 wrote to memory of 4492 3696 663C.tmp 36 PID 3696 wrote to memory of 4492 3696 663C.tmp 36 PID 3696 wrote to memory of 4492 3696 663C.tmp 36 PID 4492 wrote to memory of 5016 4492 66A9.tmp 38 PID 4492 wrote to memory of 5016 4492 66A9.tmp 38 PID 4492 wrote to memory of 5016 4492 66A9.tmp 38 PID 5016 wrote to memory of 4076 5016 6707.tmp 413 PID 5016 wrote to memory of 4076 5016 6707.tmp 413 PID 5016 wrote to memory of 4076 5016 6707.tmp 413 PID 4076 wrote to memory of 1608 4076 274A.tmp 498 PID 4076 wrote to memory of 1608 4076 274A.tmp 498 PID 4076 wrote to memory of 1608 4076 274A.tmp 498 PID 1608 wrote to memory of 1940 1608 4D8E.tmp 372 PID 1608 wrote to memory of 1940 1608 4D8E.tmp 372 PID 1608 wrote to memory of 1940 1608 4D8E.tmp 372 PID 1940 wrote to memory of 4892 1940 150A.tmp 78 PID 1940 wrote to memory of 4892 1940 150A.tmp 78 PID 1940 wrote to memory of 4892 1940 150A.tmp 78 PID 4892 wrote to memory of 4848 4892 691A.tmp 525 PID 4892 wrote to memory of 4848 4892 691A.tmp 525 PID 4892 wrote to memory of 4848 4892 691A.tmp 525 PID 4848 wrote to memory of 3520 4848 584C.tmp 76 PID 4848 wrote to memory of 3520 4848 584C.tmp 76 PID 4848 wrote to memory of 3520 4848 584C.tmp 76 PID 3520 wrote to memory of 2928 3520 69F5.tmp 254 PID 3520 wrote to memory of 2928 3520 69F5.tmp 254 PID 3520 wrote to memory of 2928 3520 69F5.tmp 254 PID 2928 wrote to memory of 3432 2928 E34B.tmp 697 PID 2928 wrote to memory of 3432 2928 E34B.tmp 697 PID 2928 wrote to memory of 3432 2928 E34B.tmp 697 PID 3432 wrote to memory of 4160 3432 C975.tmp 71 PID 3432 wrote to memory of 4160 3432 C975.tmp 71 PID 3432 wrote to memory of 4160 3432 C975.tmp 71 PID 4160 wrote to memory of 4036 4160 6B9B.tmp 258 PID 4160 wrote to memory of 4036 4160 6B9B.tmp 258 PID 4160 wrote to memory of 4036 4160 6B9B.tmp 258 PID 4036 wrote to memory of 4832 4036 E530.tmp 143 PID 4036 wrote to memory of 4832 4036 E530.tmp 143 PID 4036 wrote to memory of 4832 4036 E530.tmp 143 PID 4832 wrote to memory of 3344 4832 9069.tmp 565 PID 4832 wrote to memory of 3344 4832 9069.tmp 565 PID 4832 wrote to memory of 3344 4832 9069.tmp 565 PID 3344 wrote to memory of 3924 3344 6B57.tmp 542 PID 3344 wrote to memory of 3924 3344 6B57.tmp 542 PID 3344 wrote to memory of 3924 3344 6B57.tmp 542 PID 3924 wrote to memory of 440 3924 6107.tmp 655
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-08_792890b406d8f814a027a7cd3b39d2dc_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"2⤵PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180
-
-
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016
-
-
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"1⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"1⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892
-
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"1⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"2⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"1⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"2⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"3⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"4⤵PID:4200
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"2⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"3⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"4⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"5⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"6⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"7⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"8⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"9⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"10⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"11⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"12⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"13⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"14⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"15⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"16⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"17⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"18⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"19⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"20⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"21⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"22⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"23⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"24⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"25⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"26⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"27⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"28⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"29⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"30⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"31⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"32⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"33⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"34⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"35⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"36⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"37⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"38⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"39⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\616.tmp"C:\Users\Admin\AppData\Local\Temp\616.tmp"40⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"41⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"42⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"43⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"44⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"45⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"46⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"47⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"48⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"49⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"50⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"51⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"52⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"53⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"54⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"55⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"56⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"57⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"58⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"59⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"60⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"61⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"62⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"63⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"64⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"65⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"66⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"67⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"68⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"69⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"70⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"71⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"73⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"74⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"75⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"76⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"77⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"78⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"79⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\17D8.tmp"C:\Users\Admin\AppData\Local\Temp\17D8.tmp"80⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"81⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\18C3.tmp"C:\Users\Admin\AppData\Local\Temp\18C3.tmp"82⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"83⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"84⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"85⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"86⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"87⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"88⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"89⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"90⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"92⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"93⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"94⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"95⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"96⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"97⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"98⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"100⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"101⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"102⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"103⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"104⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"105⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"106⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"107⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\247B.tmp"C:\Users\Admin\AppData\Local\Temp\247B.tmp"108⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"109⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"110⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"111⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"112⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"114⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"115⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"116⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"117⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"118⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"119⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"120⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"121⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-