Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe
-
Size
765KB
-
MD5
8a173f0fc530596d8a0556361ff37bf5
-
SHA1
28a4cb04b533620072ddc69e246486509748b47e
-
SHA256
0fe75470cefb5f803a07e2240f1086bff7e59b133333814b782decd9c9c6b317
-
SHA512
41934806bfde376e5ad1f7c47176363cd5ba705d1c852882fc8ccc5a7c5f6abd9167d9cce75073f67cf98b967efdb75f254b96d98fd105831f717dcde29e0d9f
-
SSDEEP
12288:ZU5rCOTeiDNhDEzuE1c7byKE32qXwHWHCzc3ZF5rn5rLOa54U5w5A:ZUQOJDDDEzXcXyKEmxHCCzc3vh5Oa+Uf
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 552 4006.tmp 3080 4093.tmp 4904 4100.tmp 2044 415E.tmp 3436 50DF.tmp 3664 4239.tmp 1952 4287.tmp 404 42D5.tmp 3468 4333.tmp 3640 4391.tmp 1780 43FE.tmp 1688 445C.tmp 4016 44AA.tmp 5008 44F8.tmp 1012 4546.tmp 1600 4594.tmp 3440 45E2.tmp 4760 4631.tmp 2368 468E.tmp 3188 46EC.tmp 1584 474A.tmp 2944 4798.tmp 1384 4834.tmp 4980 4892.tmp 4816 48E0.tmp 2148 492E.tmp 1992 49BB.tmp 4388 4A09.tmp 4380 4A86.tmp 4384 4AE4.tmp 1972 4B41.tmp 5080 4B90.tmp 3044 4BDE.tmp 2012 4C2C.tmp 4068 5E1E.tmp 1564 4CD8.tmp 3296 4D35.tmp 1816 4D84.tmp 4232 4DD2.tmp 4592 4E20.tmp 1508 4E6E.tmp 2668 4EBC.tmp 116 4F0A.tmp 3392 4F58.tmp 4876 4FA6.tmp 3564 4FF5.tmp 1452 5043.tmp 4936 5091.tmp 3436 50DF.tmp 2320 512D.tmp 3992 517B.tmp 3356 51C9.tmp 448 5217.tmp 676 5266.tmp 2928 52B4.tmp 1448 5321.tmp 5028 536F.tmp 1648 53BD.tmp 1084 540B.tmp 4580 545A.tmp 5008 44F8.tmp 3264 54F6.tmp 3900 5544.tmp 4776 5592.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3808 wrote to memory of 552 3808 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 84 PID 3808 wrote to memory of 552 3808 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 84 PID 3808 wrote to memory of 552 3808 2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe 84 PID 552 wrote to memory of 3080 552 4006.tmp 88 PID 552 wrote to memory of 3080 552 4006.tmp 88 PID 552 wrote to memory of 3080 552 4006.tmp 88 PID 3080 wrote to memory of 4904 3080 4093.tmp 89 PID 3080 wrote to memory of 4904 3080 4093.tmp 89 PID 3080 wrote to memory of 4904 3080 4093.tmp 89 PID 4904 wrote to memory of 2044 4904 4100.tmp 90 PID 4904 wrote to memory of 2044 4904 4100.tmp 90 PID 4904 wrote to memory of 2044 4904 4100.tmp 90 PID 2044 wrote to memory of 3436 2044 415E.tmp 126 PID 2044 wrote to memory of 3436 2044 415E.tmp 126 PID 2044 wrote to memory of 3436 2044 415E.tmp 126 PID 3436 wrote to memory of 3664 3436 50DF.tmp 92 PID 3436 wrote to memory of 3664 3436 50DF.tmp 92 PID 3436 wrote to memory of 3664 3436 50DF.tmp 92 PID 3664 wrote to memory of 1952 3664 4239.tmp 93 PID 3664 wrote to memory of 1952 3664 4239.tmp 93 PID 3664 wrote to memory of 1952 3664 4239.tmp 93 PID 1952 wrote to memory of 404 1952 4287.tmp 95 PID 1952 wrote to memory of 404 1952 4287.tmp 95 PID 1952 wrote to memory of 404 1952 4287.tmp 95 PID 404 wrote to memory of 3468 404 42D5.tmp 94 PID 404 wrote to memory of 3468 404 42D5.tmp 94 PID 404 wrote to memory of 3468 404 42D5.tmp 94 PID 3468 wrote to memory of 3640 3468 4333.tmp 96 PID 3468 wrote to memory of 3640 3468 4333.tmp 96 PID 3468 wrote to memory of 3640 3468 4333.tmp 96 PID 3640 wrote to memory of 1780 3640 4391.tmp 171 PID 3640 wrote to memory of 1780 3640 4391.tmp 171 PID 3640 wrote to memory of 1780 3640 4391.tmp 171 PID 1780 wrote to memory of 1688 1780 43FE.tmp 97 PID 1780 wrote to memory of 1688 1780 43FE.tmp 97 PID 1780 wrote to memory of 1688 1780 43FE.tmp 97 PID 1688 wrote to memory of 4016 1688 445C.tmp 98 PID 1688 wrote to memory of 4016 1688 445C.tmp 98 PID 1688 wrote to memory of 4016 1688 445C.tmp 98 PID 4016 wrote to memory of 5008 4016 44AA.tmp 170 PID 4016 wrote to memory of 5008 4016 44AA.tmp 170 PID 4016 wrote to memory of 5008 4016 44AA.tmp 170 PID 5008 wrote to memory of 1012 5008 44F8.tmp 169 PID 5008 wrote to memory of 1012 5008 44F8.tmp 169 PID 5008 wrote to memory of 1012 5008 44F8.tmp 169 PID 1012 wrote to memory of 1600 1012 4546.tmp 168 PID 1012 wrote to memory of 1600 1012 4546.tmp 168 PID 1012 wrote to memory of 1600 1012 4546.tmp 168 PID 1600 wrote to memory of 3440 1600 4594.tmp 99 PID 1600 wrote to memory of 3440 1600 4594.tmp 99 PID 1600 wrote to memory of 3440 1600 4594.tmp 99 PID 3440 wrote to memory of 4760 3440 45E2.tmp 167 PID 3440 wrote to memory of 4760 3440 45E2.tmp 167 PID 3440 wrote to memory of 4760 3440 45E2.tmp 167 PID 4760 wrote to memory of 2368 4760 4631.tmp 166 PID 4760 wrote to memory of 2368 4760 4631.tmp 166 PID 4760 wrote to memory of 2368 4760 4631.tmp 166 PID 2368 wrote to memory of 3188 2368 468E.tmp 165 PID 2368 wrote to memory of 3188 2368 468E.tmp 165 PID 2368 wrote to memory of 3188 2368 468E.tmp 165 PID 3188 wrote to memory of 1584 3188 46EC.tmp 100 PID 3188 wrote to memory of 1584 3188 46EC.tmp 100 PID 3188 wrote to memory of 1584 3188 46EC.tmp 100 PID 1584 wrote to memory of 2944 1584 474A.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_8a173f0fc530596d8a0556361ff37bf5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"6⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760
-
-
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"2⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"3⤵
- Executes dropped EXE
PID:1384
-
-
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"1⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"2⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"3⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"4⤵
- Executes dropped EXE
PID:4384
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"1⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"2⤵
- Executes dropped EXE
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"1⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"2⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"3⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"4⤵
- Executes dropped EXE
PID:1564
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"1⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"2⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"3⤵
- Executes dropped EXE
PID:4232
-
-
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"1⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"1⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"2⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"3⤵
- Executes dropped EXE
PID:4876
-
-
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"1⤵
- Executes dropped EXE
PID:2668
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"1⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"2⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"3⤵
- Executes dropped EXE
PID:4936
-
-
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"2⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"3⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"4⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"5⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"6⤵
- Executes dropped EXE
PID:676
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"1⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"2⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"3⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"4⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"5⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"6⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"7⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"8⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"9⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"10⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"11⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"12⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"13⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"14⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"15⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"16⤵PID:4576
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"1⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"2⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"3⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"4⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"5⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"6⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"7⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"8⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"9⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"10⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"11⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"12⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"13⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"14⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"15⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"16⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"17⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"18⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"19⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"20⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"21⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"22⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"23⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"24⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"25⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"26⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"27⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"28⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"29⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"30⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"31⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"32⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"33⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"34⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"35⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"36⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"37⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"38⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"39⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"40⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"41⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"42⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"43⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"44⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"45⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"46⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"47⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"48⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"49⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"50⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"51⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"52⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"53⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"54⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"55⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"56⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"57⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"58⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"59⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"60⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"61⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"62⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"63⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"64⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"65⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"66⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"67⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"68⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"69⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"70⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"71⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"72⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"73⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"74⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"75⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"76⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"77⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"78⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"79⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"80⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"81⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"83⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"84⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"85⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"86⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"87⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"88⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"89⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"90⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"91⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"92⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"93⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"94⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"95⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"96⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"97⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"98⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"99⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"100⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"101⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"102⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"103⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"104⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"105⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"106⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"107⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"108⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"109⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"110⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"111⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"112⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"113⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"114⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"115⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"116⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"117⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"118⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"119⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"120⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"121⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"122⤵PID:4824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-