Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    215s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09/04/2024, 20:34

General

  • Target

    2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe

  • Size

    486KB

  • MD5

    41a44c00650c48e08f0e574b27122358

  • SHA1

    4ae75869bd0a586e27108f41101fed598802c79f

  • SHA256

    165a7028bd7f1dd437a54dccb709de7d3000fd5fb3f9b38c7ffaae369296a8dc

  • SHA512

    cdf5b5e4c5b7ec13ceab33345ee93269b9f95638f17438ffa664378cc02be0671a3d19a29c46874ea6022d868014f73a579c09e8db9bf5353985c6b31dcb79c9

  • SSDEEP

    12288:/U5rCOTeiDXXy5rZ2l3gVqZqESjz6cNZ:/UQOJDXXy5AiuujjN

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-09_41a44c00650c48e08f0e574b27122358_mafia.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\A3FD.tmp
      "C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2268
      • C:\Users\Admin\AppData\Local\Temp\C265.tmp
        "C:\Users\Admin\AppData\Local\Temp\C265.tmp"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:660
        • C:\Users\Admin\AppData\Local\Temp\CB0C.tmp
          "C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Users\Admin\AppData\Local\Temp\CF8F.tmp
            "C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2628
            • C:\Users\Admin\AppData\Local\Temp\DB52.tmp
              "C:\Users\Admin\AppData\Local\Temp\DB52.tmp"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1888
              • C:\Users\Admin\AppData\Local\Temp\F67F.tmp
                "C:\Users\Admin\AppData\Local\Temp\F67F.tmp"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1704
                • C:\Users\Admin\AppData\Local\Temp\F872.tmp
                  "C:\Users\Admin\AppData\Local\Temp\F872.tmp"
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1000
                  • C:\Users\Admin\AppData\Local\Temp\34B.tmp
                    "C:\Users\Admin\AppData\Local\Temp\34B.tmp"
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:2496
                    • C:\Users\Admin\AppData\Local\Temp\AAB.tmp
                      "C:\Users\Admin\AppData\Local\Temp\AAB.tmp"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:776
                      • C:\Users\Admin\AppData\Local\Temp\1BDA.tmp
                        "C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:840
                        • C:\Users\Admin\AppData\Local\Temp\1CB4.tmp
                          "C:\Users\Admin\AppData\Local\Temp\1CB4.tmp"
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:1744
                          • C:\Users\Admin\AppData\Local\Temp\1D9E.tmp
                            "C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"
                            13⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:3028
                            • C:\Users\Admin\AppData\Local\Temp\1E4A.tmp
                              "C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"
                              14⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:1128
                              • C:\Users\Admin\AppData\Local\Temp\1F05.tmp
                                "C:\Users\Admin\AppData\Local\Temp\1F05.tmp"
                                15⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:2916
                                • C:\Users\Admin\AppData\Local\Temp\1FE0.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of WriteProcessMemory
                                  PID:2112
                                  • C:\Users\Admin\AppData\Local\Temp\209B.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\209B.tmp"
                                    17⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:2848
                                    • C:\Users\Admin\AppData\Local\Temp\2175.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\2175.tmp"
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2904
                                      • C:\Users\Admin\AppData\Local\Temp\2230.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\2230.tmp"
                                        19⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:3048
                                        • C:\Users\Admin\AppData\Local\Temp\23F5.tmp
                                          "C:\Users\Admin\AppData\Local\Temp\23F5.tmp"
                                          20⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1388
                                          • C:\Users\Admin\AppData\Local\Temp\24A0.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\24A0.tmp"
                                            21⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:1776
                                            • C:\Users\Admin\AppData\Local\Temp\250E.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\250E.tmp"
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1608
                                              • C:\Users\Admin\AppData\Local\Temp\273F.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\273F.tmp"
                                                23⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:1940
                                                • C:\Users\Admin\AppData\Local\Temp\27EB.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\27EB.tmp"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  PID:748
                                                  • C:\Users\Admin\AppData\Local\Temp\2858.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\2858.tmp"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:320
                                                    • C:\Users\Admin\AppData\Local\Temp\2A6A.tmp
                                                      "C:\Users\Admin\AppData\Local\Temp\2A6A.tmp"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:3020
                                                      • C:\Users\Admin\AppData\Local\Temp\2B45.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\2B45.tmp"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:1008
                                                        • C:\Users\Admin\AppData\Local\Temp\2BB2.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:2044
                                                          • C:\Users\Admin\AppData\Local\Temp\2C3E.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:552
                                                            • C:\Users\Admin\AppData\Local\Temp\2E41.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\2E41.tmp"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:1712
                                                              • C:\Users\Admin\AppData\Local\Temp\2ECE.tmp
                                                                "C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:1948
                                                                • C:\Users\Admin\AppData\Local\Temp\5F11.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\5F11.tmp"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:2808
                                                                  • C:\Users\Admin\AppData\Local\Temp\7C61.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\7C61.tmp"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    PID:2396
                                                                    • C:\Users\Admin\AppData\Local\Temp\7F6D.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:2404
                                                                      • C:\Users\Admin\AppData\Local\Temp\9F8A.tmp
                                                                        "C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:2584
                                                                        • C:\Users\Admin\AppData\Local\Temp\C12D.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\C12D.tmp"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:2332
                                                                          • C:\Users\Admin\AppData\Local\Temp\CFAE.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            PID:2280
                                                                            • C:\Users\Admin\AppData\Local\Temp\D01B.tmp
                                                                              "C:\Users\Admin\AppData\Local\Temp\D01B.tmp"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:2364
                                                                              • C:\Users\Admin\AppData\Local\Temp\D098.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\D098.tmp"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                PID:2220
                                                                                • C:\Users\Admin\AppData\Local\Temp\D115.tmp
                                                                                  "C:\Users\Admin\AppData\Local\Temp\D115.tmp"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  PID:2056
                                                                                  • C:\Users\Admin\AppData\Local\Temp\EFFA.tmp
                                                                                    "C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Loads dropped DLL
                                                                                    PID:2504
                                                                                    • C:\Users\Admin\AppData\Local\Temp\84A.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\84A.tmp"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      PID:692
                                                                                      • C:\Users\Admin\AppData\Local\Temp\39A6.tmp
                                                                                        "C:\Users\Admin\AppData\Local\Temp\39A6.tmp"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        PID:2520
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3A04.tmp
                                                                                          "C:\Users\Admin\AppData\Local\Temp\3A04.tmp"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          PID:2636
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3A62.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\3A62.tmp"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:2476
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3ADE.tmp
                                                                                              "C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              PID:2660
                                                                                              • C:\Users\Admin\AppData\Local\Temp\3B4C.tmp
                                                                                                "C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:2676
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3BB9.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:1568
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3C36.tmp
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3C36.tmp"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Loads dropped DLL
                                                                                                    PID:952
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3D8D.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Loads dropped DLL
                                                                                                      PID:2356
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3DFA.tmp
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3DFA.tmp"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        PID:2036
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3E58.tmp
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3E58.tmp"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          PID:1736
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3EB5.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            PID:1740
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3F13.tmp
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3F13.tmp"
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:2076
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3F61.tmp
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3F61.tmp"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                PID:1452
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\40B8.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\40B8.tmp"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  PID:2524
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4125.tmp
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4125.tmp"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    PID:2760
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4193.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\4193.tmp"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:2260
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4200.tmp
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4200.tmp"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        PID:936
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\43E3.tmp
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\43E3.tmp"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:1664
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4460.tmp
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4460.tmp"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1668
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\44DD.tmp
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\44DD.tmp"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:2324
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\453B.tmp
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\453B.tmp"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Loads dropped DLL
                                                                                                                                PID:1516
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\45A8.tmp
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\45A8.tmp"
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Loads dropped DLL
                                                                                                                                  PID:2892
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4615.tmp
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4615.tmp"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2908
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\475D.tmp
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\475D.tmp"
                                                                                                                                      66⤵
                                                                                                                                        PID:1324
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\47D9.tmp
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\47D9.tmp"
                                                                                                                                          67⤵
                                                                                                                                            PID:1844
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4847.tmp
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4847.tmp"
                                                                                                                                              68⤵
                                                                                                                                                PID:2864
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\48C3.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\48C3.tmp"
                                                                                                                                                  69⤵
                                                                                                                                                    PID:3036
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8B2F.tmp
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"
                                                                                                                                                      70⤵
                                                                                                                                                        PID:1724
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\B828.tmp
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\B828.tmp"
                                                                                                                                                          71⤵
                                                                                                                                                            PID:1964
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\CEA5.tmp
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"
                                                                                                                                                              72⤵
                                                                                                                                                                PID:328
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CF22.tmp
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\CF22.tmp"
                                                                                                                                                                  73⤵
                                                                                                                                                                    PID:1900
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\CF9E.tmp
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"
                                                                                                                                                                      74⤵
                                                                                                                                                                        PID:1908
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D01C.tmp
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\D01C.tmp"
                                                                                                                                                                          75⤵
                                                                                                                                                                            PID:888
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\D23D.tmp
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\D23D.tmp"
                                                                                                                                                                              76⤵
                                                                                                                                                                                PID:960
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D2CA.tmp
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\D2CA.tmp"
                                                                                                                                                                                  77⤵
                                                                                                                                                                                    PID:3020
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D346.tmp
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\D346.tmp"
                                                                                                                                                                                      78⤵
                                                                                                                                                                                        PID:1856
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D402.tmp
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\D402.tmp"
                                                                                                                                                                                          79⤵
                                                                                                                                                                                            PID:2044
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\D604.tmp
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\D604.tmp"
                                                                                                                                                                                              80⤵
                                                                                                                                                                                                PID:1456
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D6B0.tmp
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"
                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D7D8.tmp
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"
                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                        PID:872
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\D846.tmp
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\D846.tmp"
                                                                                                                                                                                                          83⤵
                                                                                                                                                                                                            PID:1712
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\D8D2.tmp
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"
                                                                                                                                                                                                              84⤵
                                                                                                                                                                                                                PID:2856
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D94F.tmp
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\D94F.tmp"
                                                                                                                                                                                                                  85⤵
                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DBEE.tmp
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DBEE.tmp"
                                                                                                                                                                                                                      86⤵
                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DC3C.tmp
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DC3C.tmp"
                                                                                                                                                                                                                          87⤵
                                                                                                                                                                                                                            PID:2576
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DC99.tmp
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DC99.tmp"
                                                                                                                                                                                                                              88⤵
                                                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\DD06.tmp
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\DD06.tmp"
                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DD83.tmp
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DD83.tmp"
                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\DDE1.tmp
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"
                                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\DFE4.tmp
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"
                                                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                                                PID:2312

                                                        Network

                                                        MITRE ATT&CK Matrix

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\Temp\24A0.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          cf58ff52b94d8e713dd3c822bac0acf1

                                                          SHA1

                                                          a3086be46bf6aebfc0d37ecd847f4d4d748e4f0f

                                                          SHA256

                                                          c158eb1603315f32f6a6493481980ae7859e4c0f26f5d040abb4bcdad7ed423f

                                                          SHA512

                                                          ca035711c22216b436e859e235684097429a63dd3e4f1450bd42da6d56acdb3d90a593fb5f84482a2e577ffa8578ebce1c5ab9c75b43e5ba5dfe54fcb270f3bb

                                                        • C:\Users\Admin\AppData\Local\Temp\C265.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          06ed6d5d956d006525478e10bf4b0c09

                                                          SHA1

                                                          982ddb87bd42282132a3f18dc001c482edf1be59

                                                          SHA256

                                                          f0d5e51064a5626423b0d4676d8fb49e830fc7c8ed050d70cc2ad88bff8a6d4b

                                                          SHA512

                                                          e92147f9b79d124a02c93bb15a0387d9ac5fed4c8503dce367b7da057e31d0dcf725b9a5bf22995e1fc4dcd360a7719f248d3f8e1b0d3b9a6ea576f77576c2ed

                                                        • \Users\Admin\AppData\Local\Temp\1BDA.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          424f719b1e996eeec83631474155c67b

                                                          SHA1

                                                          76ef6b15c3b69a1211d92214db0efb1b1eeaeef1

                                                          SHA256

                                                          7c4cafb03ea2ede2001ce6f217c557dd4080b57a0c1a553ce510eb4e5f1bbeb7

                                                          SHA512

                                                          d888058c25509b3ca4d79afdd6a253f27d486a8e9966b7753df913cf0986230180607b4438767f29b2f986bc5aaffa5fb171cee59b2ada8e318d1f5478b6cd99

                                                        • \Users\Admin\AppData\Local\Temp\1CB4.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          867cbb65387ccb1b1ed0ffbc8151483a

                                                          SHA1

                                                          1e9f56dc05ba7c39ad59f49bd3452b4333cca09e

                                                          SHA256

                                                          085a7a911265fb116baffbae9b0d6e564ea32eef1d7a188e31e6b3005f8f790c

                                                          SHA512

                                                          6fefcc34e5dad263d8b0ddb6b23d604f6a2a32b6e3d7a7bc893b0e1206be8f07ae853e81ec1be07be1021c982b83c6458c591b8d973ea4d0390b737777927ab9

                                                        • \Users\Admin\AppData\Local\Temp\1D9E.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          90dc59e9ad755ec3c60e540ff3b635ac

                                                          SHA1

                                                          83c4e6aa6259c7327dac2cc645fab1663babb6c4

                                                          SHA256

                                                          0a5fd2d3cd19f85c431b582b86b4c41796a380bdf8b9816c10b004ca0c63141d

                                                          SHA512

                                                          0b288f600645bac990322c736adc6f980e713c3dd84023d2c679b3f91acb2139f8fd11a6d6497cc4de48de64061ede13d0b084c647af5ddefbbf9c40e9776d8c

                                                        • \Users\Admin\AppData\Local\Temp\1E4A.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          3a5244f76cc7d7fa94dadffcf630761a

                                                          SHA1

                                                          ec8b5179b0b2a2799b3c956c86abd4933f2b3e96

                                                          SHA256

                                                          5853a49be5039a0a9a3bae8c8625cd7ba4f06ecc4606c9a4b5b0ee77713e3491

                                                          SHA512

                                                          7fa01cf6ec3aabba0edc2182afe09305942377352b561d2c677cd44aa0149e567bb251b9cd1a02af1ba9f4fd646352dd3a49b1a1acae62c50e6b26a5e6eb66d0

                                                        • \Users\Admin\AppData\Local\Temp\1F05.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          73269afbf8c3892be31671f068420df7

                                                          SHA1

                                                          b95b0e10c3ce9489be334601a70df4ff1a40698d

                                                          SHA256

                                                          807b49bbc05d6bf95d6601a5081fac4e42401e59b1ffa7f6849bbcc0cfaf2a7a

                                                          SHA512

                                                          3e2dbbd1b88a2d935f242b7500abd46d8381d1093567d7f4b0feb52f7e8ce377fb67ba0009ffe0650f2ad1a40e6385f4a547df97c37a9a2623195eb1aa274a99

                                                        • \Users\Admin\AppData\Local\Temp\1FE0.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          5ba487b1a44b7977c8c9459bd9dc9ede

                                                          SHA1

                                                          32f396796e63ed233817dd65693d9b629ed2e1aa

                                                          SHA256

                                                          d98c1aa45e8301593b5a8c74c52820080fd81ccfcf6d02a467a49a06f003f293

                                                          SHA512

                                                          a9b8e64183d427e5cf0a17dd5c0a9e3888c8dbf2296c0ae7b252342b1b56ada3285353a33b612dac95f2c18263b1180c855edbd7c737f231f2197fcd946e1f7f

                                                        • \Users\Admin\AppData\Local\Temp\209B.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          62a63850c0844a7c5f5055b273aa3398

                                                          SHA1

                                                          e038e42c17a346d8284c6eb80615f1051ebb1f14

                                                          SHA256

                                                          ea2335733c03fcddbb0ff1dc30c138aeb6869a0f8eb022011a9550c54cbfb230

                                                          SHA512

                                                          e1099bc97419a8a9ea97bf0cc7d14fb57368e335475be7c5d335688e73720244c35f35cc5893abadfdcb31ff911ca01a1d99de360384033caa43437e9cd053fb

                                                        • \Users\Admin\AppData\Local\Temp\2175.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          884d2927f80db75a19a0c69e290c1fd1

                                                          SHA1

                                                          f7a33d22d04e0e98bd9c07330029114cb20bf6f6

                                                          SHA256

                                                          3edd0efe4e662323638015dcaafe107d38171138459d3f57949245175bc646b0

                                                          SHA512

                                                          c288960f4fbbedce77f6f3ff1cb46d238b15290a60d9c87243159366eae7e5a8282fc73faeb9333d920c75bebc431f15c83e659d79d6fbac50785eabb6854a1c

                                                        • \Users\Admin\AppData\Local\Temp\2230.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          ba72136b25935708475523b3fbf8705c

                                                          SHA1

                                                          2c6ed8182c6b8d901f8a3737a061cbbb72138373

                                                          SHA256

                                                          2ac66c80c5b9db4b7b1b1426c8317999993fcb8ed2b237dfc9fce72c8db01c04

                                                          SHA512

                                                          5cc2371eaf307661a43c3dbcb5e73c259e79f44cc6c6e42b1a4add0562fdd02265a45058a89845ed508f278dbca706275feffadabe4ba30b67ba4456ffc98fbf

                                                        • \Users\Admin\AppData\Local\Temp\23F5.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          fdbadbbd4cc7d898fd4e731b7e1b3c0a

                                                          SHA1

                                                          5bdce4dca7904741a90eedc4ef1f9b6095c221b3

                                                          SHA256

                                                          d48af1010d5589c04a1b940ed9ab5db32e7f64497f4c06eb5f00218256142df0

                                                          SHA512

                                                          a3598993be5a55022a7fe850a52002752ddc8cd137e820053d115c56eb70418efa4ad0aba670810971f3a0c930e651de993c10b4c050e17851dd45452966c39e

                                                        • \Users\Admin\AppData\Local\Temp\250E.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          1f67af4e2c1518ae49f836c2943cbacf

                                                          SHA1

                                                          92436f124251091817a9397fb02c0c52977e497a

                                                          SHA256

                                                          f9bd4e9f3136c73e2b7eefdb4f67ea39bfafc2dcf2f3ad9ad3a545a7dee76392

                                                          SHA512

                                                          676f15e3cf378e05091322da85c1f7abc2bfc96194571833090f0d1fb6ce729a41bc53de0507f537e6e2ff583c4fc38845a5cd2ff9d05a9e30456db9793eef84

                                                        • \Users\Admin\AppData\Local\Temp\273F.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          b6192853ccfbe4dd517cf2152a12631c

                                                          SHA1

                                                          8569a5621b616745d4ac17f38ceb0d098a654c87

                                                          SHA256

                                                          7e6127eb19885fab9352f29096cc26f492baed773333ce1296c3662045fb4f5a

                                                          SHA512

                                                          b7dd67a0a6a6ec1e6370956b41d841a406e41a39abdc1055599bf90c1b50a6c30ee4fd3955e23af674c54227ac177fa3c925000d44c318a8d9d33451986a5541

                                                        • \Users\Admin\AppData\Local\Temp\34B.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          6a8b7b383408c49bbf07ca6afe52bbea

                                                          SHA1

                                                          151efdd59b54ae7461bf147bbed8460dd89cdbce

                                                          SHA256

                                                          ed26c28aa3d48e0701e236e79577692bb25dba6ca4663875af6e93f0c9fe6547

                                                          SHA512

                                                          a12fe90d682adf8608be075bad7400601b1472d7c2cc3ca14127fc7a855dc22d255fe612535185350942c2157d31b463f236aa70d86f966df87dd14d8e9e7beb

                                                        • \Users\Admin\AppData\Local\Temp\A3FD.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          8f451690c8958a2a40c014ef5f1a77d2

                                                          SHA1

                                                          6d5c5aab2e1852921bf0bef9700b6620aba3a044

                                                          SHA256

                                                          614f82017a07085ce4998f72db3a3f0c15336ee1ca4ff999e8cb010e532671a4

                                                          SHA512

                                                          909b2dafcbf4e74d4dbcaf083261f30e2d56546b2f29cdeb2e9a6e0952cf29cbf19b682a48e0fdc9b6233c472d02471d56e322695814a383df2242546c069861

                                                        • \Users\Admin\AppData\Local\Temp\AAB.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          5c13fc99a3f584481fff114458658a24

                                                          SHA1

                                                          f24389df7c268655bffe7b35ac7fa4cfde16e27b

                                                          SHA256

                                                          9fc8056a14944c65e7c2e8fd55da5af095a7cf7255664325509d828ec167c67f

                                                          SHA512

                                                          fefe30275793394c5a42192d86ef67bee3f2c298f8a5a86c5496189ac52e4d56ee2c3355a6783593eae64813b85e5c493d374fc3caa2dce1274cc8496d6a78ec

                                                        • \Users\Admin\AppData\Local\Temp\CB0C.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          1d88e8b018f1a6bc1cb850b98054af9a

                                                          SHA1

                                                          26a6e89b95ffab23e2106019d4286505c1ed59c6

                                                          SHA256

                                                          229b3e221d47f1bba806ba285797e612c2a2f7f3084b11a64d47f1c4a0c3023f

                                                          SHA512

                                                          b6d9d7af4f56ed1a7efe968c1febd2c6de599c3250274e544ee6ef71419fb04ad4650ef72b1631ae29e6fa383de13d7a42e0afe567feda68a129a72d137e4199

                                                        • \Users\Admin\AppData\Local\Temp\CF8F.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          b0758dc4177f460c6d8d41c6b0b86bd8

                                                          SHA1

                                                          45131bc29d37b2412f69e4b96844b7b58d4caedb

                                                          SHA256

                                                          f1dad1e5ef7a3ec70a9bea1e69559d9e0bbbc46c01926d3029ba2f48d6f7852c

                                                          SHA512

                                                          98605461018d08ffca9fd4467fd17b98f99d797ef423ba9a844394f5c8747a6c304db5d2245ec5652ab29497ecf787b833b006ad111b06fbefad45677c7dd72c

                                                        • \Users\Admin\AppData\Local\Temp\DB52.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          a1082563b94f4b086f0a6ddfa5b93aaf

                                                          SHA1

                                                          ccdc1838d73c6f22a7aee139f4447a168ba224b6

                                                          SHA256

                                                          b339b8f43c014b68f97cfaf51f7d1fb922002717e6c1d1293d6c9ab198af592e

                                                          SHA512

                                                          8f9a6d3136b304eda9b873d6eb33cfe5ff70e2fbe49123949be06047954a5fa110eda21303537ac084986e2b626deffe1e8613884f97bcbf3424a3a077277540

                                                        • \Users\Admin\AppData\Local\Temp\F67F.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          51a289f7967975c8647dcfedeaf29a7d

                                                          SHA1

                                                          c7141475473984b1696bdbf9d3c7acf265332cf1

                                                          SHA256

                                                          69c068e978df0fecc83198bf42d228398940acb65a41a1e0eb2ed2e540be0fc4

                                                          SHA512

                                                          ce122505499ec413ca08f275b17937607a046ac7e713475a23f17f8387865a07fcdf2266b25277fa8326d0a4a19e534bca98b3549ecc963a2d0247b22ecbb8bc

                                                        • \Users\Admin\AppData\Local\Temp\F872.tmp

                                                          Filesize

                                                          486KB

                                                          MD5

                                                          c43bb430dfbf770cc330a72b5c79d451

                                                          SHA1

                                                          d9ccd6389dec5dcf7b626fbb6c62fe52cc8ad92f

                                                          SHA256

                                                          071aee9da73edd10e1943cfe74b5d84b988ed3b8cf1b969cac9bbec9aedd4c37

                                                          SHA512

                                                          687a1ba3c442955b03a051d86c4516feabfa33a07be69d2aba11ae4c5ef4ad116efe7e588d5ebaa42dbfe4bdd6e2a950c177dbb42b75b8db33efac867ae26fb8