Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe
-
Size
486KB
-
MD5
392a827f6957fdb0c2a8b51d0c29975a
-
SHA1
8adb2c4e6b8e652313396ff833dea9b24cc25cb4
-
SHA256
03cb5ad24961707f6690bb9c78ef003b2713c1432ab2b402c21b63f5c80db317
-
SHA512
d57647851eef9c14bd54c00a734b1e1c495a0b173d4ede8ae2b1404395a42e403afe458360717e48a266aa92617386e190450b61593ba8ae42cac8bc8756b097
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7BQYRTaK1lqEyFhg1p8pR8NXJXVeAoAor5sHT:/U5rCOTeiDBQYRTaw03gI8V+KNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1964 4D26.tmp 4940 63BB.tmp 2884 4E6E.tmp 1260 4EEB.tmp 4352 6522.tmp 4188 4FB6.tmp 1896 5033.tmp 4800 50CF.tmp 880 514C.tmp 3144 51C9.tmp 3868 686E.tmp 4988 52B4.tmp 8 69C6.tmp 3020 53AE.tmp 668 541B.tmp 1468 5488.tmp 2360 5515.tmp 1996 5573.tmp 2296 55E0.tmp 2188 6D6F.tmp 652 6DCD.tmp 2728 Conhost.exe 2756 57B5.tmp 3076 6EF6.tmp 2764 6F63.tmp 1912 58FD.tmp 2768 596A.tmp 1104 59E7.tmp 2880 5A45.tmp 4900 5AA3.tmp 3864 5B10.tmp 4676 5B7E.tmp 1804 5BEB.tmp 636 5C49.tmp 1308 5CB6.tmp 2808 5D33.tmp 4372 5D91.tmp 3208 5DEF.tmp 4012 5E4C.tmp 2200 5E9B.tmp 2348 5EE9.tmp 3352 5F56.tmp 4180 5FA4.tmp 3396 6031.tmp 1400 607F.tmp 2916 60DD.tmp 544 612B.tmp 4448 6189.tmp 1208 61E6.tmp 444 6234.tmp 3508 6292.tmp 4048 6300.tmp 856 635D.tmp 4940 63BB.tmp 468 6409.tmp 1868 6467.tmp 4292 64B5.tmp 4352 6522.tmp 1552 6580.tmp 3592 65CE.tmp 3888 663C.tmp 3440 66A9.tmp 3404 66F7.tmp 1388 6745.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1964 1464 2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe 86 PID 1464 wrote to memory of 1964 1464 2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe 86 PID 1464 wrote to memory of 1964 1464 2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe 86 PID 1964 wrote to memory of 4940 1964 4D26.tmp 139 PID 1964 wrote to memory of 4940 1964 4D26.tmp 139 PID 1964 wrote to memory of 4940 1964 4D26.tmp 139 PID 4940 wrote to memory of 2884 4940 63BB.tmp 88 PID 4940 wrote to memory of 2884 4940 63BB.tmp 88 PID 4940 wrote to memory of 2884 4940 63BB.tmp 88 PID 2884 wrote to memory of 1260 2884 4E6E.tmp 89 PID 2884 wrote to memory of 1260 2884 4E6E.tmp 89 PID 2884 wrote to memory of 1260 2884 4E6E.tmp 89 PID 1260 wrote to memory of 4352 1260 4EEB.tmp 143 PID 1260 wrote to memory of 4352 1260 4EEB.tmp 143 PID 1260 wrote to memory of 4352 1260 4EEB.tmp 143 PID 4352 wrote to memory of 4188 4352 6522.tmp 90 PID 4352 wrote to memory of 4188 4352 6522.tmp 90 PID 4352 wrote to memory of 4188 4352 6522.tmp 90 PID 4188 wrote to memory of 1896 4188 4FB6.tmp 91 PID 4188 wrote to memory of 1896 4188 4FB6.tmp 91 PID 4188 wrote to memory of 1896 4188 4FB6.tmp 91 PID 1896 wrote to memory of 4800 1896 5033.tmp 93 PID 1896 wrote to memory of 4800 1896 5033.tmp 93 PID 1896 wrote to memory of 4800 1896 5033.tmp 93 PID 4800 wrote to memory of 880 4800 50CF.tmp 94 PID 4800 wrote to memory of 880 4800 50CF.tmp 94 PID 4800 wrote to memory of 880 4800 50CF.tmp 94 PID 880 wrote to memory of 3144 880 514C.tmp 95 PID 880 wrote to memory of 3144 880 514C.tmp 95 PID 880 wrote to memory of 3144 880 514C.tmp 95 PID 3144 wrote to memory of 3868 3144 51C9.tmp 152 PID 3144 wrote to memory of 3868 3144 51C9.tmp 152 PID 3144 wrote to memory of 3868 3144 51C9.tmp 152 PID 3868 wrote to memory of 4988 3868 686E.tmp 97 PID 3868 wrote to memory of 4988 3868 686E.tmp 97 PID 3868 wrote to memory of 4988 3868 686E.tmp 97 PID 4988 wrote to memory of 8 4988 52B4.tmp 155 PID 4988 wrote to memory of 8 4988 52B4.tmp 155 PID 4988 wrote to memory of 8 4988 52B4.tmp 155 PID 8 wrote to memory of 3020 8 69C6.tmp 99 PID 8 wrote to memory of 3020 8 69C6.tmp 99 PID 8 wrote to memory of 3020 8 69C6.tmp 99 PID 3020 wrote to memory of 668 3020 53AE.tmp 100 PID 3020 wrote to memory of 668 3020 53AE.tmp 100 PID 3020 wrote to memory of 668 3020 53AE.tmp 100 PID 668 wrote to memory of 1468 668 541B.tmp 101 PID 668 wrote to memory of 1468 668 541B.tmp 101 PID 668 wrote to memory of 1468 668 541B.tmp 101 PID 1468 wrote to memory of 2360 1468 5488.tmp 104 PID 1468 wrote to memory of 2360 1468 5488.tmp 104 PID 1468 wrote to memory of 2360 1468 5488.tmp 104 PID 2360 wrote to memory of 1996 2360 5515.tmp 102 PID 2360 wrote to memory of 1996 2360 5515.tmp 102 PID 2360 wrote to memory of 1996 2360 5515.tmp 102 PID 1996 wrote to memory of 2296 1996 5573.tmp 103 PID 1996 wrote to memory of 2296 1996 5573.tmp 103 PID 1996 wrote to memory of 2296 1996 5573.tmp 103 PID 2296 wrote to memory of 2188 2296 55E0.tmp 164 PID 2296 wrote to memory of 2188 2296 55E0.tmp 164 PID 2296 wrote to memory of 2188 2296 55E0.tmp 164 PID 2188 wrote to memory of 652 2188 6D6F.tmp 165 PID 2188 wrote to memory of 652 2188 6D6F.tmp 165 PID 2188 wrote to memory of 652 2188 6D6F.tmp 165 PID 652 wrote to memory of 2728 652 6DCD.tmp 166
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_392a827f6957fdb0c2a8b51d0c29975a_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"3⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"6⤵PID:4352
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"6⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"8⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"3⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"4⤵PID:652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"1⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"2⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"3⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"4⤵
- Executes dropped EXE
PID:1912
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"1⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"2⤵
- Executes dropped EXE
PID:2880
-
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"1⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"2⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"3⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"4⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"5⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"6⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"7⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"8⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"9⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"10⤵
- Executes dropped EXE
PID:4012
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"1⤵
- Executes dropped EXE
PID:2768
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"1⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"2⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"3⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"4⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"5⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"6⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"7⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"8⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"9⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"10⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"11⤵
- Executes dropped EXE
PID:444 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"12⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"13⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"14⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"16⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"17⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"18⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"20⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"21⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"22⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"23⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"24⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"25⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"26⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"27⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"29⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"30⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"32⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"33⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"34⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"35⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"36⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"37⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"38⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"39⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"42⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"43⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"44⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"45⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"46⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"47⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"48⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"49⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"50⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"51⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"52⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"53⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"54⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"55⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"56⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"57⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"58⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"59⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"60⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"61⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"62⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"63⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"64⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"65⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"66⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"67⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"68⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"69⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"70⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"71⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"72⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"73⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"74⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"75⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"76⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"77⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"78⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"79⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"80⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"81⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"82⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"83⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"85⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"86⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"87⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"88⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"89⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"90⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"91⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"92⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"93⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"94⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"95⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"96⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"97⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"98⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"99⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"100⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"101⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"102⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"103⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"104⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"105⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"106⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"107⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"108⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"109⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"110⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"111⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"112⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"113⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"114⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"115⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"116⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"117⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"118⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"119⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"120⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"121⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"122⤵PID:412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-