Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/08/2023, 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2277c6f74571c997814c310e4db2f368_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2277c6f74571c997814c310e4db2f368_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2277c6f74571c997814c310e4db2f368_mafia_JC.exe
-
Size
488KB
-
MD5
2277c6f74571c997814c310e4db2f368
-
SHA1
5a57b4cb66414b9ba4ad3fa27bdcee7f97540ba1
-
SHA256
0baa3f58d15443c3793f6ef724facab56b7388e0f19d8ea920b78096a29e7b65
-
SHA512
8557553096d9d737f559e7035f5e9c28c5053ae7162d563df8cab12bdb1715fd7b18e85922fd1908670f9ce8965604f6bfa86931fdbd1faccf82ba34705b5c9e
-
SSDEEP
12288:/U5rCOTeiDdhLc5EukxuTRYfMQyvhRNZ:/UQOJDdhLcyHffMQuRN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2248 DF19.tmp 1116 DFA5.tmp 1748 E15A.tmp 2436 E244.tmp 1208 E30F.tmp 2472 E3E9.tmp 536 E4C4.tmp 2468 E5AE.tmp 2832 E688.tmp 2992 E734.tmp 2884 E83D.tmp 2120 E936.tmp 2904 E994.tmp 3044 EA01.tmp 2796 EB49.tmp 2784 EBA6.tmp 640 ECCF.tmp 2012 ED7A.tmp 1548 EEA3.tmp 2624 EF9C.tmp 1780 F0C5.tmp 2196 F1AF.tmp 2652 F26A.tmp 1672 F2F6.tmp 1272 F383.tmp 1392 F40F.tmp 2936 F47C.tmp 2924 F4F9.tmp 2372 F576.tmp 2164 F602.tmp 2928 F670.tmp 1508 F6CD.tmp 2396 F769.tmp 432 F7C7.tmp 1072 F834.tmp 1840 F8A1.tmp 988 F90E.tmp 2044 F99B.tmp 2560 FA08.tmp 1896 FA85.tmp 2100 FB21.tmp 1932 FB8E.tmp 968 FC1A.tmp 2544 FC88.tmp 2124 FD14.tmp 2424 FD91.tmp 2552 FE1D.tmp 2716 FE9A.tmp 524 FF07.tmp 2632 FF94.tmp 1668 30.tmp 1784 DB.tmp 2264 158.tmp 2516 204.tmp 1648 280.tmp 1532 33C.tmp 1808 3A9.tmp 1172 4A2.tmp 1252 55E.tmp 2136 5FA.tmp 2460 712.tmp 340 78F.tmp 2332 81C.tmp 2172 889.tmp -
Loads dropped DLL 64 IoCs
pid Process 2268 2277c6f74571c997814c310e4db2f368_mafia_JC.exe 2248 DF19.tmp 1116 DFA5.tmp 1748 E15A.tmp 2436 E244.tmp 1208 E30F.tmp 2472 E3E9.tmp 536 E4C4.tmp 2468 E5AE.tmp 2832 E688.tmp 2992 E734.tmp 2884 E83D.tmp 2120 E936.tmp 2904 E994.tmp 3044 EA01.tmp 2796 EB49.tmp 2784 EBA6.tmp 640 ECCF.tmp 2012 ED7A.tmp 1548 EEA3.tmp 2624 EF9C.tmp 1780 F0C5.tmp 2196 F1AF.tmp 2652 F26A.tmp 1672 F2F6.tmp 1272 F383.tmp 1392 F40F.tmp 2936 F47C.tmp 2924 F4F9.tmp 2372 F576.tmp 2164 F602.tmp 2928 F670.tmp 1508 F6CD.tmp 2396 F769.tmp 432 F7C7.tmp 1072 F834.tmp 1840 F8A1.tmp 988 F90E.tmp 2044 F99B.tmp 2560 FA08.tmp 1896 FA85.tmp 2100 FB21.tmp 1932 FB8E.tmp 968 FC1A.tmp 2544 FC88.tmp 2124 FD14.tmp 2424 FD91.tmp 2552 FE1D.tmp 2716 FE9A.tmp 524 FF07.tmp 2632 FF94.tmp 1668 30.tmp 1784 DB.tmp 2264 158.tmp 2516 204.tmp 1648 280.tmp 1532 33C.tmp 1808 3A9.tmp 1172 4A2.tmp 1252 55E.tmp 2136 5FA.tmp 2460 712.tmp 340 78F.tmp 2332 81C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2248 2268 2277c6f74571c997814c310e4db2f368_mafia_JC.exe 28 PID 2268 wrote to memory of 2248 2268 2277c6f74571c997814c310e4db2f368_mafia_JC.exe 28 PID 2268 wrote to memory of 2248 2268 2277c6f74571c997814c310e4db2f368_mafia_JC.exe 28 PID 2268 wrote to memory of 2248 2268 2277c6f74571c997814c310e4db2f368_mafia_JC.exe 28 PID 2248 wrote to memory of 1116 2248 DF19.tmp 29 PID 2248 wrote to memory of 1116 2248 DF19.tmp 29 PID 2248 wrote to memory of 1116 2248 DF19.tmp 29 PID 2248 wrote to memory of 1116 2248 DF19.tmp 29 PID 1116 wrote to memory of 1748 1116 DFA5.tmp 30 PID 1116 wrote to memory of 1748 1116 DFA5.tmp 30 PID 1116 wrote to memory of 1748 1116 DFA5.tmp 30 PID 1116 wrote to memory of 1748 1116 DFA5.tmp 30 PID 1748 wrote to memory of 2436 1748 E15A.tmp 31 PID 1748 wrote to memory of 2436 1748 E15A.tmp 31 PID 1748 wrote to memory of 2436 1748 E15A.tmp 31 PID 1748 wrote to memory of 2436 1748 E15A.tmp 31 PID 2436 wrote to memory of 1208 2436 E244.tmp 32 PID 2436 wrote to memory of 1208 2436 E244.tmp 32 PID 2436 wrote to memory of 1208 2436 E244.tmp 32 PID 2436 wrote to memory of 1208 2436 E244.tmp 32 PID 1208 wrote to memory of 2472 1208 E30F.tmp 33 PID 1208 wrote to memory of 2472 1208 E30F.tmp 33 PID 1208 wrote to memory of 2472 1208 E30F.tmp 33 PID 1208 wrote to memory of 2472 1208 E30F.tmp 33 PID 2472 wrote to memory of 536 2472 E3E9.tmp 34 PID 2472 wrote to memory of 536 2472 E3E9.tmp 34 PID 2472 wrote to memory of 536 2472 E3E9.tmp 34 PID 2472 wrote to memory of 536 2472 E3E9.tmp 34 PID 536 wrote to memory of 2468 536 E4C4.tmp 35 PID 536 wrote to memory of 2468 536 E4C4.tmp 35 PID 536 wrote to memory of 2468 536 E4C4.tmp 35 PID 536 wrote to memory of 2468 536 E4C4.tmp 35 PID 2468 wrote to memory of 2832 2468 E5AE.tmp 36 PID 2468 wrote to memory of 2832 2468 E5AE.tmp 36 PID 2468 wrote to memory of 2832 2468 E5AE.tmp 36 PID 2468 wrote to memory of 2832 2468 E5AE.tmp 36 PID 2832 wrote to memory of 2992 2832 E688.tmp 37 PID 2832 wrote to memory of 2992 2832 E688.tmp 37 PID 2832 wrote to memory of 2992 2832 E688.tmp 37 PID 2832 wrote to memory of 2992 2832 E688.tmp 37 PID 2992 wrote to memory of 2884 2992 E734.tmp 38 PID 2992 wrote to memory of 2884 2992 E734.tmp 38 PID 2992 wrote to memory of 2884 2992 E734.tmp 38 PID 2992 wrote to memory of 2884 2992 E734.tmp 38 PID 2884 wrote to memory of 2120 2884 E83D.tmp 40 PID 2884 wrote to memory of 2120 2884 E83D.tmp 40 PID 2884 wrote to memory of 2120 2884 E83D.tmp 40 PID 2884 wrote to memory of 2120 2884 E83D.tmp 40 PID 2120 wrote to memory of 2904 2120 E936.tmp 41 PID 2120 wrote to memory of 2904 2120 E936.tmp 41 PID 2120 wrote to memory of 2904 2120 E936.tmp 41 PID 2120 wrote to memory of 2904 2120 E936.tmp 41 PID 2904 wrote to memory of 3044 2904 E994.tmp 42 PID 2904 wrote to memory of 3044 2904 E994.tmp 42 PID 2904 wrote to memory of 3044 2904 E994.tmp 42 PID 2904 wrote to memory of 3044 2904 E994.tmp 42 PID 3044 wrote to memory of 2796 3044 EA01.tmp 44 PID 3044 wrote to memory of 2796 3044 EA01.tmp 44 PID 3044 wrote to memory of 2796 3044 EA01.tmp 44 PID 3044 wrote to memory of 2796 3044 EA01.tmp 44 PID 2796 wrote to memory of 2784 2796 EB49.tmp 45 PID 2796 wrote to memory of 2784 2796 EB49.tmp 45 PID 2796 wrote to memory of 2784 2796 EB49.tmp 45 PID 2796 wrote to memory of 2784 2796 EB49.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2277c6f74571c997814c310e4db2f368_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2277c6f74571c997814c310e4db2f368_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\DF19.tmp"C:\Users\Admin\AppData\Local\Temp\DF19.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:640 -
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"C:\Users\Admin\AppData\Local\Temp\EEA3.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"C:\Users\Admin\AppData\Local\Temp\EF9C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\F47C.tmp"C:\Users\Admin\AppData\Local\Temp\F47C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"C:\Users\Admin\AppData\Local\Temp\F7C7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432 -
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:988 -
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\FA08.tmp"C:\Users\Admin\AppData\Local\Temp\FA08.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:968 -
C:\Users\Admin\AppData\Local\Temp\FC88.tmp"C:\Users\Admin\AppData\Local\Temp\FC88.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\FD91.tmp"C:\Users\Admin\AppData\Local\Temp\FD91.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\280.tmp"C:\Users\Admin\AppData\Local\Temp\280.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\33C.tmp"C:\Users\Admin\AppData\Local\Temp\33C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5FA.tmp"C:\Users\Admin\AppData\Local\Temp\5FA.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"65⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\906.tmp"C:\Users\Admin\AppData\Local\Temp\906.tmp"66⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"67⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A0F.tmp"C:\Users\Admin\AppData\Local\Temp\A0F.tmp"68⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"69⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"70⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"71⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"72⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"73⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"74⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"75⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"76⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"77⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"78⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"79⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"80⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"81⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"82⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"83⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"84⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"85⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"86⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"87⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\13DE.tmp"C:\Users\Admin\AppData\Local\Temp\13DE.tmp"88⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"89⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\14D8.tmp"C:\Users\Admin\AppData\Local\Temp\14D8.tmp"90⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\1555.tmp"C:\Users\Admin\AppData\Local\Temp\1555.tmp"91⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"92⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"93⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"94⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1738.tmp"C:\Users\Admin\AppData\Local\Temp\1738.tmp"95⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\17C5.tmp"C:\Users\Admin\AppData\Local\Temp\17C5.tmp"96⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"97⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"98⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"99⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"100⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"101⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"102⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"103⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"104⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"C:\Users\Admin\AppData\Local\Temp\1DCD.tmp"105⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"106⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"107⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"108⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"109⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"110⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"111⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"112⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"113⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"114⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\225F.tmp"C:\Users\Admin\AppData\Local\Temp\225F.tmp"115⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"116⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"117⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"118⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"119⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"120⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"121⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-