Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe
-
Size
486KB
-
MD5
48978b4e5bd83fdc14037107e068d752
-
SHA1
4cc00513411644fa36d011ba9bb3352a83476dd7
-
SHA256
e9dd43187d20c52ca24dbf6ac51a3f281e2d76ecaff8a38c86f1b8b820d2e93d
-
SHA512
d6a64b8b8913090eba439fb4775068725e6e5dc9d92bd79c360e9fd992cb87e736f36e3456d13944b0aba3aa95545b69d9e145744fcb1d02a768c76325c2d0da
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7lNm9gXgFImdefw/q/xIIThnOCFjNnLPFpgsz:oU5rCOTeiD3m9NIB/eShnv9VFppNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1448 82A7.tmp 1756 8315.tmp 3032 841E.tmp 2496 84C9.tmp 2660 85B3.tmp 2460 864F.tmp 2148 86BD.tmp 2548 8749.tmp 2608 C82F.tmp 2244 890D.tmp 2408 89D8.tmp 2404 8A93.tmp 2336 CA03.tmp 328 1E88.tmp 1368 8CB5.tmp 756 CBC7.tmp 2568 8DED.tmp 2596 CDE9.tmp 1800 CE47.tmp 1128 2211.tmp 1912 22CC.tmp 1252 91E3.tmp 2000 927F.tmp 1728 7002.tmp 948 A3E.tmp 1588 93B7.tmp 952 74E2.tmp 2552 737B.tmp 2812 9627.tmp 2728 72C0.tmp 772 E24.tmp 572 8F83.tmp 2156 97DC.tmp 2288 753F.tmp 2984 DA7.tmp 1068 9943.tmp 1152 D8C2.tmp 956 AB1E.tmp 1060 17A6.tmp 784 7899.tmp 1184 934B.tmp 672 782C.tmp 1844 9203.tmp 1944 AE2B.tmp 900 ACA4.tmp 2176 474D.tmp 2076 96A4.tmp 2308 1593.tmp 2864 B126.tmp 2764 9F1D.tmp 2820 6410.tmp 1464 A016.tmp 2008 7DC7.tmp 2988 80E3.tmp 2056 C255.tmp 2292 9A3D.tmp 2252 A267.tmp 2900 9CEB.tmp 1404 A351.tmp 2512 B339.tmp 2484 A44B.tmp 2676 A4C7.tmp 2508 81BD.tmp 2360 67A9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2980 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 1448 82A7.tmp 1756 8315.tmp 3032 841E.tmp 2496 84C9.tmp 2660 85B3.tmp 2460 864F.tmp 2148 86BD.tmp 2548 8749.tmp 2608 C82F.tmp 2244 890D.tmp 2408 89D8.tmp 2404 8A93.tmp 2336 CA03.tmp 328 1E88.tmp 1368 8CB5.tmp 756 CBC7.tmp 2568 38EB.tmp 2596 CDE9.tmp 1800 CE47.tmp 1128 2211.tmp 1912 22CC.tmp 1252 713A.tmp 2000 927F.tmp 1728 7002.tmp 948 A3E.tmp 1588 93B7.tmp 952 74E2.tmp 2552 737B.tmp 2812 9627.tmp 2728 72C0.tmp 772 E24.tmp 572 8F83.tmp 2156 97DC.tmp 2288 753F.tmp 2984 DA7.tmp 1068 9943.tmp 1152 D8C2.tmp 956 AB1E.tmp 1060 17A6.tmp 784 7899.tmp 1184 934B.tmp 672 782C.tmp 1844 9203.tmp 1944 AE2B.tmp 900 ACA4.tmp 2176 474D.tmp 2076 96A4.tmp 2308 1593.tmp 2864 B126.tmp 2764 9F1D.tmp 2820 6410.tmp 1464 A016.tmp 2008 7DC7.tmp 2988 80E3.tmp 2056 C255.tmp 2292 9A3D.tmp 2252 A267.tmp 2900 9CEB.tmp 1404 A351.tmp 2512 B339.tmp 2484 A44B.tmp 2676 A4C7.tmp 2508 81BD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1448 2980 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 23 PID 2980 wrote to memory of 1448 2980 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 23 PID 2980 wrote to memory of 1448 2980 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 23 PID 2980 wrote to memory of 1448 2980 2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe 23 PID 1448 wrote to memory of 1756 1448 82A7.tmp 22 PID 1448 wrote to memory of 1756 1448 82A7.tmp 22 PID 1448 wrote to memory of 1756 1448 82A7.tmp 22 PID 1448 wrote to memory of 1756 1448 82A7.tmp 22 PID 1756 wrote to memory of 3032 1756 8315.tmp 30 PID 1756 wrote to memory of 3032 1756 8315.tmp 30 PID 1756 wrote to memory of 3032 1756 8315.tmp 30 PID 1756 wrote to memory of 3032 1756 8315.tmp 30 PID 3032 wrote to memory of 2496 3032 841E.tmp 31 PID 3032 wrote to memory of 2496 3032 841E.tmp 31 PID 3032 wrote to memory of 2496 3032 841E.tmp 31 PID 3032 wrote to memory of 2496 3032 841E.tmp 31 PID 2496 wrote to memory of 2660 2496 84C9.tmp 32 PID 2496 wrote to memory of 2660 2496 84C9.tmp 32 PID 2496 wrote to memory of 2660 2496 84C9.tmp 32 PID 2496 wrote to memory of 2660 2496 84C9.tmp 32 PID 2660 wrote to memory of 2460 2660 85B3.tmp 33 PID 2660 wrote to memory of 2460 2660 85B3.tmp 33 PID 2660 wrote to memory of 2460 2660 85B3.tmp 33 PID 2660 wrote to memory of 2460 2660 85B3.tmp 33 PID 2460 wrote to memory of 2148 2460 864F.tmp 34 PID 2460 wrote to memory of 2148 2460 864F.tmp 34 PID 2460 wrote to memory of 2148 2460 864F.tmp 34 PID 2460 wrote to memory of 2148 2460 864F.tmp 34 PID 2148 wrote to memory of 2548 2148 86BD.tmp 35 PID 2148 wrote to memory of 2548 2148 86BD.tmp 35 PID 2148 wrote to memory of 2548 2148 86BD.tmp 35 PID 2148 wrote to memory of 2548 2148 86BD.tmp 35 PID 2548 wrote to memory of 2608 2548 8749.tmp 164 PID 2548 wrote to memory of 2608 2548 8749.tmp 164 PID 2548 wrote to memory of 2608 2548 8749.tmp 164 PID 2548 wrote to memory of 2608 2548 8749.tmp 164 PID 2608 wrote to memory of 2244 2608 C82F.tmp 37 PID 2608 wrote to memory of 2244 2608 C82F.tmp 37 PID 2608 wrote to memory of 2244 2608 C82F.tmp 37 PID 2608 wrote to memory of 2244 2608 C82F.tmp 37 PID 2244 wrote to memory of 2408 2244 890D.tmp 38 PID 2244 wrote to memory of 2408 2244 890D.tmp 38 PID 2244 wrote to memory of 2408 2244 890D.tmp 38 PID 2244 wrote to memory of 2408 2244 890D.tmp 38 PID 2408 wrote to memory of 2404 2408 89D8.tmp 39 PID 2408 wrote to memory of 2404 2408 89D8.tmp 39 PID 2408 wrote to memory of 2404 2408 89D8.tmp 39 PID 2408 wrote to memory of 2404 2408 89D8.tmp 39 PID 2404 wrote to memory of 2336 2404 8A93.tmp 168 PID 2404 wrote to memory of 2336 2404 8A93.tmp 168 PID 2404 wrote to memory of 2336 2404 8A93.tmp 168 PID 2404 wrote to memory of 2336 2404 8A93.tmp 168 PID 2336 wrote to memory of 328 2336 CA03.tmp 365 PID 2336 wrote to memory of 328 2336 CA03.tmp 365 PID 2336 wrote to memory of 328 2336 CA03.tmp 365 PID 2336 wrote to memory of 328 2336 CA03.tmp 365 PID 328 wrote to memory of 1368 328 1E88.tmp 42 PID 328 wrote to memory of 1368 328 1E88.tmp 42 PID 328 wrote to memory of 1368 328 1E88.tmp 42 PID 328 wrote to memory of 1368 328 1E88.tmp 42 PID 1368 wrote to memory of 756 1368 8CB5.tmp 172 PID 1368 wrote to memory of 756 1368 8CB5.tmp 172 PID 1368 wrote to memory of 756 1368 8CB5.tmp 172 PID 1368 wrote to memory of 756 1368 8CB5.tmp 172
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_48978b4e5bd83fdc14037107e068d752_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1448
-
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"8⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"12⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"13⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"15⤵PID:756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"1⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8E99.tmp"C:\Users\Admin\AppData\Local\Temp\8E99.tmp"2⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"3⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"4⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"5⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"6⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"8⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"9⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\953D.tmp"C:\Users\Admin\AppData\Local\Temp\953D.tmp"11⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"12⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"14⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"15⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"16⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"18⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"19⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"21⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"22⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"23⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"24⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"25⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"26⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"27⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"28⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"29⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"30⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"31⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"32⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"33⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"C:\Users\Admin\AppData\Local\Temp\9F1D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"35⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"37⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"38⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"39⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"40⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"42⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"44⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\A44B.tmp"C:\Users\Admin\AppData\Local\Temp\A44B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"47⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"48⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"49⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"50⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"51⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"52⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"53⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"54⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"55⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"56⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"57⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"58⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"59⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"60⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"61⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"62⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"63⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"64⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"65⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"66⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"67⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"68⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"69⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"70⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"71⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"72⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"73⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"74⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"75⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"76⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"77⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"78⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"79⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\B54B.tmp"C:\Users\Admin\AppData\Local\Temp\B54B.tmp"80⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"81⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"82⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"83⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"85⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"86⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"87⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"88⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"89⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"90⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"91⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"93⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"94⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"96⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"97⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"98⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"99⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"100⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"101⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"102⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"103⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"104⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"105⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"106⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"107⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"108⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"109⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"110⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"111⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\C468.tmp"C:\Users\Admin\AppData\Local\Temp\C468.tmp"112⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"113⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"114⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"115⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"116⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\C699.tmp"C:\Users\Admin\AppData\Local\Temp\C699.tmp"117⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"118⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"119⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"120⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C82F.tmp"C:\Users\Admin\AppData\Local\Temp\C82F.tmp"121⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-