Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe
-
Size
486KB
-
MD5
725ee6a8141c963987a3bcc00961318f
-
SHA1
40b647f9d203daa8dec8e5369117ae148392b19d
-
SHA256
58e7d15ea155944aaac1ede6fa909e31a3afde6ac958362a19008f6b80a7e2d6
-
SHA512
82a48ffd36556f8e5ab8a596380842bfe7bc915d35b08b3cf79ee121a74b28be6a0492ed83beb02067b6b3e2ce07daf34adbe09097e23804f2c5cceb64ed96cd
-
SSDEEP
12288:/U5rCOTeiDbm9FqeklPGdueEZxbxTqKGMrzdNZ:/UQOJDbaFoPGduegbFGmN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2604 803C.tmp 4484 80C9.tmp 3184 9451.tmp 1100 C043.tmp 2292 8240.tmp 3048 82AD.tmp 4820 831A.tmp 4448 8397.tmp 3532 8424.tmp 4668 8491.tmp 4776 854D.tmp 2648 85CA.tmp 600 8656.tmp 1788 86B4.tmp 3460 8731.tmp 3608 879F.tmp 3704 882B.tmp 2924 B556.tmp 4916 89D1.tmp 1980 8A4E.tmp 848 B71B.tmp 1500 8B77.tmp 4812 B844.tmp 4148 8C71.tmp 5000 8D0D.tmp 2168 8D8A.tmp 4640 8E17.tmp 3552 8E84.tmp 4964 8F11.tmp 2356 8F8E.tmp 3248 900B.tmp 220 90A7.tmp 3332 9143.tmp 1424 svchost.exe 3484 922E.tmp 2020 A99E.tmp 2128 9337.tmp 1928 9395.tmp 3184 9451.tmp 1328 94BE.tmp 4840 955A.tmp 1692 95D7.tmp 3220 9645.tmp 4612 ACBB.tmp 1544 971F.tmp 492 979C.tmp 1332 C709.tmp 2076 C7B5.tmp 2776 9923.tmp 2200 B083.tmp 4368 9A1D.tmp 2904 9A9A.tmp 4740 9B17.tmp 1344 9B84.tmp 5020 9C11.tmp 3240 CC87.tmp 4984 9CEC.tmp 4888 9D59.tmp 1668 B47B.tmp 1584 B4D9.tmp 2924 B556.tmp 1460 B5E2.tmp 4828 B650.tmp 4920 B6AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 2604 4664 2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe 86 PID 4664 wrote to memory of 2604 4664 2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe 86 PID 4664 wrote to memory of 2604 4664 2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe 86 PID 2604 wrote to memory of 4484 2604 803C.tmp 84 PID 2604 wrote to memory of 4484 2604 803C.tmp 84 PID 2604 wrote to memory of 4484 2604 803C.tmp 84 PID 4484 wrote to memory of 3184 4484 80C9.tmp 69 PID 4484 wrote to memory of 3184 4484 80C9.tmp 69 PID 4484 wrote to memory of 3184 4484 80C9.tmp 69 PID 3184 wrote to memory of 1100 3184 9451.tmp 229 PID 3184 wrote to memory of 1100 3184 9451.tmp 229 PID 3184 wrote to memory of 1100 3184 9451.tmp 229 PID 1100 wrote to memory of 2292 1100 C043.tmp 34 PID 1100 wrote to memory of 2292 1100 C043.tmp 34 PID 1100 wrote to memory of 2292 1100 C043.tmp 34 PID 2292 wrote to memory of 3048 2292 8240.tmp 35 PID 2292 wrote to memory of 3048 2292 8240.tmp 35 PID 2292 wrote to memory of 3048 2292 8240.tmp 35 PID 3048 wrote to memory of 4820 3048 82AD.tmp 36 PID 3048 wrote to memory of 4820 3048 82AD.tmp 36 PID 3048 wrote to memory of 4820 3048 82AD.tmp 36 PID 4820 wrote to memory of 4448 4820 831A.tmp 38 PID 4820 wrote to memory of 4448 4820 831A.tmp 38 PID 4820 wrote to memory of 4448 4820 831A.tmp 38 PID 4448 wrote to memory of 3532 4448 8397.tmp 81 PID 4448 wrote to memory of 3532 4448 8397.tmp 81 PID 4448 wrote to memory of 3532 4448 8397.tmp 81 PID 3532 wrote to memory of 4668 3532 8424.tmp 39 PID 3532 wrote to memory of 4668 3532 8424.tmp 39 PID 3532 wrote to memory of 4668 3532 8424.tmp 39 PID 4668 wrote to memory of 4776 4668 8491.tmp 78 PID 4668 wrote to memory of 4776 4668 8491.tmp 78 PID 4668 wrote to memory of 4776 4668 8491.tmp 78 PID 4776 wrote to memory of 2648 4776 854D.tmp 76 PID 4776 wrote to memory of 2648 4776 854D.tmp 76 PID 4776 wrote to memory of 2648 4776 854D.tmp 76 PID 2648 wrote to memory of 600 2648 85CA.tmp 41 PID 2648 wrote to memory of 600 2648 85CA.tmp 41 PID 2648 wrote to memory of 600 2648 85CA.tmp 41 PID 600 wrote to memory of 1788 600 8656.tmp 48 PID 600 wrote to memory of 1788 600 8656.tmp 48 PID 600 wrote to memory of 1788 600 8656.tmp 48 PID 1788 wrote to memory of 3460 1788 86B4.tmp 42 PID 1788 wrote to memory of 3460 1788 86B4.tmp 42 PID 1788 wrote to memory of 3460 1788 86B4.tmp 42 PID 3460 wrote to memory of 3608 3460 8731.tmp 44 PID 3460 wrote to memory of 3608 3460 8731.tmp 44 PID 3460 wrote to memory of 3608 3460 8731.tmp 44 PID 3608 wrote to memory of 3704 3608 879F.tmp 43 PID 3608 wrote to memory of 3704 3608 879F.tmp 43 PID 3608 wrote to memory of 3704 3608 879F.tmp 43 PID 3704 wrote to memory of 2924 3704 882B.tmp 205 PID 3704 wrote to memory of 2924 3704 882B.tmp 205 PID 3704 wrote to memory of 2924 3704 882B.tmp 205 PID 2924 wrote to memory of 4916 2924 B556.tmp 46 PID 2924 wrote to memory of 4916 2924 B556.tmp 46 PID 2924 wrote to memory of 4916 2924 B556.tmp 46 PID 4916 wrote to memory of 1980 4916 89D1.tmp 47 PID 4916 wrote to memory of 1980 4916 89D1.tmp 47 PID 4916 wrote to memory of 1980 4916 89D1.tmp 47 PID 1980 wrote to memory of 848 1980 8A4E.tmp 209 PID 1980 wrote to memory of 848 1980 8A4E.tmp 209 PID 1980 wrote to memory of 848 1980 8A4E.tmp 209 PID 848 wrote to memory of 1500 848 B71B.tmp 51
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_725ee6a8141c963987a3bcc00961318f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604
-
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"1⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"1⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608
-
-
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"2⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"5⤵PID:848
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"1⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"2⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"3⤵
- Executes dropped EXE
PID:5000
-
-
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"1⤵
- Executes dropped EXE
PID:1500
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"1⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"2⤵
- Executes dropped EXE
PID:3552
-
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"1⤵
- Executes dropped EXE
PID:2168
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"1⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"2⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"3⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"4⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"5⤵
- Executes dropped EXE
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"6⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"7⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"8⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"9⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"10⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"12⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"13⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"14⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"15⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"16⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"17⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"18⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"19⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"20⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"21⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"22⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"23⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"24⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"25⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"26⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"27⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"28⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"29⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"30⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"31⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"32⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"33⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"34⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"35⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"36⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"37⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"38⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"39⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"40⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"41⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"42⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"43⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"44⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"45⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"46⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"47⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"48⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"49⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"50⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"51⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"52⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"53⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"54⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"55⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"56⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"57⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"58⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"59⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"60⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"61⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"62⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"63⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"64⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"65⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"66⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"67⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"68⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"69⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"70⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"71⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"72⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"73⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"74⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"75⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"76⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"77⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"78⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"79⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"80⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"81⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"82⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"83⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"84⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"85⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"86⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"87⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"88⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"89⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"90⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"91⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"92⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"93⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"94⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"95⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"96⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"97⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"98⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"99⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"100⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"101⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"102⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"103⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"104⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"105⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"106⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"107⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"108⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"109⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"110⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"111⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"112⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"113⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"114⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"115⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"116⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"117⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"118⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"119⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"120⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"121⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\CA93.tmp"C:\Users\Admin\AppData\Local\Temp\CA93.tmp"122⤵PID:4020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-