Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
22/08/2023, 16:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe
-
Size
488KB
-
MD5
6b63edd2321d74ea9064c22c559a08da
-
SHA1
737bdb2839eba79d54e908ca76d090eb4e6f0807
-
SHA256
161a70c0010f7a61576a939341d7693734c39b424cb05f914022766c4ad22fd6
-
SHA512
b911c08afd1f7576e4b221fa1a30d761cae5f0307b3946fa728944c64bdcd19ead1f60a8462dc4c4244279e375974c74f28b7031551087ee5217be05ce096323
-
SSDEEP
12288:/U5rCOTeiDC4ZaN+ON0EYU/PsOKyVWS0zNZ:/UQOJDhwN50EH/PX6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 8121.tmp 2848 81CD.tmp 3004 8298.tmp 2252 8391.tmp 1428 846C.tmp 2952 8556.tmp 2872 8630.tmp 2708 872A.tmp 2780 87E5.tmp 1628 88DF.tmp 592 89B9.tmp 1296 8AB3.tmp 1484 8B8D.tmp 1952 8CB5.tmp 1564 8DAF.tmp 2156 8EA9.tmp 2284 8F83.tmp 3024 907D.tmp 1956 9147.tmp 1932 9212.tmp 2896 9415.tmp 548 94FF.tmp 3064 95CA.tmp 2612 9647.tmp 624 96C3.tmp 1436 9721.tmp 1068 979E.tmp 808 981B.tmp 1156 9897.tmp 2068 9905.tmp 2320 9962.tmp 2460 99DF.tmp 2144 9A5C.tmp 1128 9AD9.tmp 1208 9B46.tmp 2632 9BB3.tmp 2680 9C30.tmp 1096 9C7E.tmp 1180 9CEB.tmp 1740 9D58.tmp 1700 9DC5.tmp 1544 9E52.tmp 1728 9EAF.tmp 1052 9F2C.tmp 868 9F8A.tmp 948 9FF7.tmp 2216 A083.tmp 2512 A100.tmp 2084 A17D.tmp 1108 A209.tmp 312 A286.tmp 2308 A2F3.tmp 864 A38F.tmp 364 A3FD.tmp 1612 A46A.tmp 1600 A4C7.tmp 2344 A554.tmp 1780 A5E0.tmp 2832 A65D.tmp 2856 A6CA.tmp 3000 A728.tmp 2836 A785.tmp 2820 A988.tmp 3012 A9F5.tmp -
Loads dropped DLL 64 IoCs
pid Process 2196 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 2388 8121.tmp 2848 81CD.tmp 3004 8298.tmp 2252 8391.tmp 1428 846C.tmp 2952 8556.tmp 2872 8630.tmp 2708 872A.tmp 2780 87E5.tmp 1628 88DF.tmp 592 89B9.tmp 1296 8AB3.tmp 1484 8B8D.tmp 1952 8CB5.tmp 1564 8DAF.tmp 2156 8EA9.tmp 2284 8F83.tmp 3024 907D.tmp 1956 9147.tmp 1932 9212.tmp 2896 9415.tmp 548 94FF.tmp 3064 95CA.tmp 2612 9647.tmp 624 96C3.tmp 1436 9721.tmp 1068 979E.tmp 808 981B.tmp 1156 9897.tmp 2068 9905.tmp 2320 9962.tmp 2460 99DF.tmp 2144 9A5C.tmp 1128 9AD9.tmp 1208 9B46.tmp 2632 9BB3.tmp 2680 9C30.tmp 1096 9C7E.tmp 1180 9CEB.tmp 1740 9D58.tmp 1700 9DC5.tmp 1544 9E52.tmp 1728 9EAF.tmp 1052 9F2C.tmp 868 9F8A.tmp 948 9FF7.tmp 2216 A083.tmp 2512 A100.tmp 2084 A17D.tmp 1108 A209.tmp 312 A286.tmp 2308 A2F3.tmp 864 A38F.tmp 364 A3FD.tmp 1612 A46A.tmp 1600 A4C7.tmp 2344 A554.tmp 1780 A5E0.tmp 2832 A65D.tmp 2856 A6CA.tmp 3000 A728.tmp 2836 A785.tmp 2820 A988.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2388 2196 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 28 PID 2196 wrote to memory of 2388 2196 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 28 PID 2196 wrote to memory of 2388 2196 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 28 PID 2196 wrote to memory of 2388 2196 6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe 28 PID 2388 wrote to memory of 2848 2388 8121.tmp 29 PID 2388 wrote to memory of 2848 2388 8121.tmp 29 PID 2388 wrote to memory of 2848 2388 8121.tmp 29 PID 2388 wrote to memory of 2848 2388 8121.tmp 29 PID 2848 wrote to memory of 3004 2848 81CD.tmp 30 PID 2848 wrote to memory of 3004 2848 81CD.tmp 30 PID 2848 wrote to memory of 3004 2848 81CD.tmp 30 PID 2848 wrote to memory of 3004 2848 81CD.tmp 30 PID 3004 wrote to memory of 2252 3004 8298.tmp 31 PID 3004 wrote to memory of 2252 3004 8298.tmp 31 PID 3004 wrote to memory of 2252 3004 8298.tmp 31 PID 3004 wrote to memory of 2252 3004 8298.tmp 31 PID 2252 wrote to memory of 1428 2252 8391.tmp 32 PID 2252 wrote to memory of 1428 2252 8391.tmp 32 PID 2252 wrote to memory of 1428 2252 8391.tmp 32 PID 2252 wrote to memory of 1428 2252 8391.tmp 32 PID 1428 wrote to memory of 2952 1428 846C.tmp 33 PID 1428 wrote to memory of 2952 1428 846C.tmp 33 PID 1428 wrote to memory of 2952 1428 846C.tmp 33 PID 1428 wrote to memory of 2952 1428 846C.tmp 33 PID 2952 wrote to memory of 2872 2952 8556.tmp 34 PID 2952 wrote to memory of 2872 2952 8556.tmp 34 PID 2952 wrote to memory of 2872 2952 8556.tmp 34 PID 2952 wrote to memory of 2872 2952 8556.tmp 34 PID 2872 wrote to memory of 2708 2872 8630.tmp 35 PID 2872 wrote to memory of 2708 2872 8630.tmp 35 PID 2872 wrote to memory of 2708 2872 8630.tmp 35 PID 2872 wrote to memory of 2708 2872 8630.tmp 35 PID 2708 wrote to memory of 2780 2708 872A.tmp 36 PID 2708 wrote to memory of 2780 2708 872A.tmp 36 PID 2708 wrote to memory of 2780 2708 872A.tmp 36 PID 2708 wrote to memory of 2780 2708 872A.tmp 36 PID 2780 wrote to memory of 1628 2780 87E5.tmp 37 PID 2780 wrote to memory of 1628 2780 87E5.tmp 37 PID 2780 wrote to memory of 1628 2780 87E5.tmp 37 PID 2780 wrote to memory of 1628 2780 87E5.tmp 37 PID 1628 wrote to memory of 592 1628 88DF.tmp 38 PID 1628 wrote to memory of 592 1628 88DF.tmp 38 PID 1628 wrote to memory of 592 1628 88DF.tmp 38 PID 1628 wrote to memory of 592 1628 88DF.tmp 38 PID 592 wrote to memory of 1296 592 89B9.tmp 39 PID 592 wrote to memory of 1296 592 89B9.tmp 39 PID 592 wrote to memory of 1296 592 89B9.tmp 39 PID 592 wrote to memory of 1296 592 89B9.tmp 39 PID 1296 wrote to memory of 1484 1296 8AB3.tmp 40 PID 1296 wrote to memory of 1484 1296 8AB3.tmp 40 PID 1296 wrote to memory of 1484 1296 8AB3.tmp 40 PID 1296 wrote to memory of 1484 1296 8AB3.tmp 40 PID 1484 wrote to memory of 1952 1484 8B8D.tmp 41 PID 1484 wrote to memory of 1952 1484 8B8D.tmp 41 PID 1484 wrote to memory of 1952 1484 8B8D.tmp 41 PID 1484 wrote to memory of 1952 1484 8B8D.tmp 41 PID 1952 wrote to memory of 1564 1952 8CB5.tmp 42 PID 1952 wrote to memory of 1564 1952 8CB5.tmp 42 PID 1952 wrote to memory of 1564 1952 8CB5.tmp 42 PID 1952 wrote to memory of 1564 1952 8CB5.tmp 42 PID 1564 wrote to memory of 2156 1564 8DAF.tmp 43 PID 1564 wrote to memory of 2156 1564 8DAF.tmp 43 PID 1564 wrote to memory of 2156 1564 8DAF.tmp 43 PID 1564 wrote to memory of 2156 1564 8DAF.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\6b63edd2321d74ea9064c22c559a08da_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8121.tmp"C:\Users\Admin\AppData\Local\Temp\8121.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\8391.tmp"C:\Users\Admin\AppData\Local\Temp\8391.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"C:\Users\Admin\AppData\Local\Temp\8EA9.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9415.tmp"C:\Users\Admin\AppData\Local\Temp\9415.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A100.tmp"C:\Users\Admin\AppData\Local\Temp\A100.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:312 -
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:364 -
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"65⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"66⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"67⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"69⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"71⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"72⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"73⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"74⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"75⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"76⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"77⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"78⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"79⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"80⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"81⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"82⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"83⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"84⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"85⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"86⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"88⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"89⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"90⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"91⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"92⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"93⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"94⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"95⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"96⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"97⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"98⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"99⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"100⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"101⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"102⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"103⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"104⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"105⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"106⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"107⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"108⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"109⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"110⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"111⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"112⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"113⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"114⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"115⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"116⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"117⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"118⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"119⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"120⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"121⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"122⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-