Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 16:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
-
Size
486KB
-
MD5
2e1320a87b8f5dc299cf017d739e5cf2
-
SHA1
ab9b19ba0a8991ad9a49840f5a2c6ca53b5b912c
-
SHA256
ae9674452d0b9eb2935d1221be1e7969ca8e2c7756bca30f996d6a13bae881a7
-
SHA512
4f7e353e9353fca78ec5b28f6f73b94cadc18b71753e09a10e448c62ad70b2637ba11ae919be90d8f7d1e33222debab7126e0d62b86e5b85dd4dab947593fa0a
-
SSDEEP
12288:UU5rCOTeiDpMP5LRBtYX1Ii/urA8+k7LD9E3NZ:UUQOJDqxLZmIRrApkPDyN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3020 CC63.tmp 1352 CD2E.tmp 2084 CE95.tmp 1400 CF7F.tmp 2068 D079.tmp 2236 D153.tmp 2336 D25C.tmp 588 D327.tmp 2752 D430.tmp 2808 D4FB.tmp 2904 D5F5.tmp 2168 D6DF.tmp 1704 D7F7.tmp 2688 D8C2.tmp 2828 D9CB.tmp 2660 DAA6.tmp 2712 DB9F.tmp 1640 DC3B.tmp 2640 DD73.tmp 2188 DEAC.tmp 2240 DFB5.tmp 2632 E0FC.tmp 2032 E1D7.tmp 1204 E263.tmp 2012 E30F.tmp 2216 E38C.tmp 2212 E408.tmp 1848 E476.tmp 1764 E4F2.tmp 1972 E560.tmp 2028 E5CD.tmp 1864 E63A.tmp 284 E6A7.tmp 2984 E734.tmp 2932 E791.tmp 1784 E80E.tmp 1552 E85C.tmp 1396 E8BA.tmp 980 E936.tmp 1368 E994.tmp 2520 EA01.tmp 1940 EA6E.tmp 920 EADC.tmp 1652 EB49.tmp 2956 EBC6.tmp 596 EC42.tmp 1500 ECB0.tmp 1200 ED0D.tmp 1808 ED7A.tmp 2332 EDF7.tmp 2312 EE55.tmp 2388 EEC2.tmp 1584 EF3F.tmp 1620 EF9C.tmp 1328 F00A.tmp 2468 F077.tmp 1756 F0F4.tmp 2080 F161.tmp 2456 F1DE.tmp 1340 F2A8.tmp 2180 F344.tmp 2560 F3D1.tmp 1912 F42E.tmp 2484 F49C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2912 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 3020 CC63.tmp 1352 CD2E.tmp 2084 CE95.tmp 1400 CF7F.tmp 2068 D079.tmp 2236 D153.tmp 2336 D25C.tmp 588 D327.tmp 2752 D430.tmp 2808 D4FB.tmp 2904 D5F5.tmp 2168 D6DF.tmp 1704 D7F7.tmp 2688 D8C2.tmp 2828 D9CB.tmp 2660 DAA6.tmp 2712 DB9F.tmp 1640 DC3B.tmp 2640 DD73.tmp 2188 DEAC.tmp 2240 DFB5.tmp 2632 E0FC.tmp 2032 E1D7.tmp 1204 E263.tmp 2012 E30F.tmp 2216 E38C.tmp 2212 E408.tmp 1848 E476.tmp 1764 E4F2.tmp 1972 E560.tmp 2028 E5CD.tmp 1864 E63A.tmp 284 E6A7.tmp 2984 E734.tmp 2932 E791.tmp 1784 E80E.tmp 1552 E85C.tmp 1396 E8BA.tmp 980 E936.tmp 1368 E994.tmp 2520 EA01.tmp 1940 EA6E.tmp 920 EADC.tmp 1652 EB49.tmp 2956 EBC6.tmp 596 EC42.tmp 1500 ECB0.tmp 1200 ED0D.tmp 1808 ED7A.tmp 2332 EDF7.tmp 2312 EE55.tmp 2388 EEC2.tmp 1584 EF3F.tmp 1620 EF9C.tmp 1328 F00A.tmp 2468 F077.tmp 1756 F0F4.tmp 2080 F161.tmp 2456 F1DE.tmp 1340 F2A8.tmp 2180 F344.tmp 2560 F3D1.tmp 1912 F42E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3020 2912 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 28 PID 2912 wrote to memory of 3020 2912 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 28 PID 2912 wrote to memory of 3020 2912 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 28 PID 2912 wrote to memory of 3020 2912 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 28 PID 3020 wrote to memory of 1352 3020 CC63.tmp 29 PID 3020 wrote to memory of 1352 3020 CC63.tmp 29 PID 3020 wrote to memory of 1352 3020 CC63.tmp 29 PID 3020 wrote to memory of 1352 3020 CC63.tmp 29 PID 1352 wrote to memory of 2084 1352 CD2E.tmp 30 PID 1352 wrote to memory of 2084 1352 CD2E.tmp 30 PID 1352 wrote to memory of 2084 1352 CD2E.tmp 30 PID 1352 wrote to memory of 2084 1352 CD2E.tmp 30 PID 2084 wrote to memory of 1400 2084 CE95.tmp 31 PID 2084 wrote to memory of 1400 2084 CE95.tmp 31 PID 2084 wrote to memory of 1400 2084 CE95.tmp 31 PID 2084 wrote to memory of 1400 2084 CE95.tmp 31 PID 1400 wrote to memory of 2068 1400 CF7F.tmp 32 PID 1400 wrote to memory of 2068 1400 CF7F.tmp 32 PID 1400 wrote to memory of 2068 1400 CF7F.tmp 32 PID 1400 wrote to memory of 2068 1400 CF7F.tmp 32 PID 2068 wrote to memory of 2236 2068 D079.tmp 33 PID 2068 wrote to memory of 2236 2068 D079.tmp 33 PID 2068 wrote to memory of 2236 2068 D079.tmp 33 PID 2068 wrote to memory of 2236 2068 D079.tmp 33 PID 2236 wrote to memory of 2336 2236 D153.tmp 34 PID 2236 wrote to memory of 2336 2236 D153.tmp 34 PID 2236 wrote to memory of 2336 2236 D153.tmp 34 PID 2236 wrote to memory of 2336 2236 D153.tmp 34 PID 2336 wrote to memory of 588 2336 D25C.tmp 35 PID 2336 wrote to memory of 588 2336 D25C.tmp 35 PID 2336 wrote to memory of 588 2336 D25C.tmp 35 PID 2336 wrote to memory of 588 2336 D25C.tmp 35 PID 588 wrote to memory of 2752 588 D327.tmp 36 PID 588 wrote to memory of 2752 588 D327.tmp 36 PID 588 wrote to memory of 2752 588 D327.tmp 36 PID 588 wrote to memory of 2752 588 D327.tmp 36 PID 2752 wrote to memory of 2808 2752 D430.tmp 37 PID 2752 wrote to memory of 2808 2752 D430.tmp 37 PID 2752 wrote to memory of 2808 2752 D430.tmp 37 PID 2752 wrote to memory of 2808 2752 D430.tmp 37 PID 2808 wrote to memory of 2904 2808 D4FB.tmp 38 PID 2808 wrote to memory of 2904 2808 D4FB.tmp 38 PID 2808 wrote to memory of 2904 2808 D4FB.tmp 38 PID 2808 wrote to memory of 2904 2808 D4FB.tmp 38 PID 2904 wrote to memory of 2168 2904 D5F5.tmp 39 PID 2904 wrote to memory of 2168 2904 D5F5.tmp 39 PID 2904 wrote to memory of 2168 2904 D5F5.tmp 39 PID 2904 wrote to memory of 2168 2904 D5F5.tmp 39 PID 2168 wrote to memory of 1704 2168 D6DF.tmp 40 PID 2168 wrote to memory of 1704 2168 D6DF.tmp 40 PID 2168 wrote to memory of 1704 2168 D6DF.tmp 40 PID 2168 wrote to memory of 1704 2168 D6DF.tmp 40 PID 1704 wrote to memory of 2688 1704 D7F7.tmp 41 PID 1704 wrote to memory of 2688 1704 D7F7.tmp 41 PID 1704 wrote to memory of 2688 1704 D7F7.tmp 41 PID 1704 wrote to memory of 2688 1704 D7F7.tmp 41 PID 2688 wrote to memory of 2828 2688 D8C2.tmp 42 PID 2688 wrote to memory of 2828 2688 D8C2.tmp 42 PID 2688 wrote to memory of 2828 2688 D8C2.tmp 42 PID 2688 wrote to memory of 2828 2688 D8C2.tmp 42 PID 2828 wrote to memory of 2660 2828 D9CB.tmp 43 PID 2828 wrote to memory of 2660 2828 D9CB.tmp 43 PID 2828 wrote to memory of 2660 2828 D9CB.tmp 43 PID 2828 wrote to memory of 2660 2828 D9CB.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\D153.tmp"C:\Users\Admin\AppData\Local\Temp\D153.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"C:\Users\Admin\AppData\Local\Temp\D7F7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"C:\Users\Admin\AppData\Local\Temp\DB9F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"C:\Users\Admin\AppData\Local\Temp\EEC2.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\F161.tmp"C:\Users\Admin\AppData\Local\Temp\F161.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"65⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"66⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"67⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"68⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\F650.tmp"C:\Users\Admin\AppData\Local\Temp\F650.tmp"69⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"70⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"71⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\F788.tmp"C:\Users\Admin\AppData\Local\Temp\F788.tmp"72⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"73⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\F844.tmp"C:\Users\Admin\AppData\Local\Temp\F844.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"75⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"76⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"77⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"78⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"79⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"80⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"81⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"C:\Users\Admin\AppData\Local\Temp\FC0B.tmp"82⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"83⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"84⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\FD43.tmp"C:\Users\Admin\AppData\Local\Temp\FD43.tmp"85⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"86⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"87⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"88⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"89⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"90⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"91⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5E.tmp"C:\Users\Admin\AppData\Local\Temp\5E.tmp"92⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"93⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"94⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"95⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\232.tmp"C:\Users\Admin\AppData\Local\Temp\232.tmp"96⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\2BF.tmp"C:\Users\Admin\AppData\Local\Temp\2BF.tmp"97⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"98⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"99⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"100⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"101⤵PID:284
-
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"102⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"103⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp"104⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"106⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"107⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"108⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"109⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"110⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"111⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\A8C.tmp"C:\Users\Admin\AppData\Local\Temp\A8C.tmp"112⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"113⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"114⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"115⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"116⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"117⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"118⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"119⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"120⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"121⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"122⤵PID:2420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-