Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230824-en -
resource tags
arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system -
submitted
24/08/2023, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
-
Size
486KB
-
MD5
86dd9ae53242a13ba1084f4ab13f38ac
-
SHA1
5415c16d03def03602928c404f1067bdf0a45d28
-
SHA256
9b0595a2de7a57a90dcffddcdf7357e703731c19703e2016f303b450b3f6e3f0
-
SHA512
e165d82e638d700d862a1a684181dff1469ef441bd4466c40e11fec808b4745606d4777b36afafc86cb548f33687159cdbfad9612fd65ea2e6ad2d2cd96bdfcc
-
SSDEEP
12288:/U5rCOTeiDThVtO0FnLofqkMkWMipmQ2RgNZ:/UQOJDdD2qkhDuJQgN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1292 F103.tmp 924 F1BE.tmp 2068 F2D7.tmp 3004 F3B2.tmp 2908 F45D.tmp 2948 F509.tmp 2600 F5D4.tmp 2604 F69E.tmp 2764 F75A.tmp 2924 F7F6.tmp 2500 F8B1.tmp 2460 F98B.tmp 2424 FA37.tmp 1772 FAD3.tmp 2848 FB8E.tmp 1920 FC59.tmp 1188 FCF5.tmp 2000 FDC0.tmp 1712 FE8A.tmp 1472 FF65.tmp 1752 10.tmp 1120 CC.tmp 1636 168.tmp 1924 1C5.tmp 2388 242.tmp 912 2A0.tmp 2260 2FD.tmp 2224 36A.tmp 2268 3D8.tmp 2204 435.tmp 2228 493.tmp 2472 510.tmp 2480 56D.tmp 2008 5CB.tmp 624 628.tmp 1488 6B5.tmp 1828 712.tmp 1740 780.tmp 956 7DD.tmp 1888 925.tmp 2012 982.tmp 1708 A4D.tmp 2936 AAB.tmp 2980 B56.tmp 1452 BE3.tmp 852 C40.tmp 2992 CBD.tmp 2964 D4A.tmp 872 DA7.tmp 2792 E72.tmp 2084 ED0.tmp 1592 F3D.tmp 572 FAA.tmp 2076 1017.tmp 1292 1084.tmp 2180 10E2.tmp 2028 1140.tmp 2068 11BC.tmp 2308 120A.tmp 3004 1287.tmp 2892 12E5.tmp 2540 1342.tmp 2616 13B0.tmp 2652 141D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2276 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 1292 F103.tmp 924 F1BE.tmp 2068 F2D7.tmp 3004 F3B2.tmp 2908 F45D.tmp 2948 F509.tmp 2600 F5D4.tmp 2604 F69E.tmp 2764 F75A.tmp 2924 F7F6.tmp 2500 F8B1.tmp 2460 F98B.tmp 2424 FA37.tmp 1772 FAD3.tmp 2848 FB8E.tmp 1920 FC59.tmp 1188 FCF5.tmp 2000 FDC0.tmp 1712 FE8A.tmp 1472 FF65.tmp 1752 10.tmp 1120 CC.tmp 1636 168.tmp 1924 1C5.tmp 2388 242.tmp 912 2A0.tmp 2260 2FD.tmp 2224 36A.tmp 2268 3D8.tmp 2204 435.tmp 2228 493.tmp 2472 510.tmp 2480 56D.tmp 2008 5CB.tmp 624 628.tmp 1488 6B5.tmp 1828 712.tmp 1740 780.tmp 956 7DD.tmp 1888 925.tmp 2012 982.tmp 1708 A4D.tmp 2936 AAB.tmp 2980 B56.tmp 1452 BE3.tmp 852 C40.tmp 2992 CBD.tmp 2964 D4A.tmp 872 DA7.tmp 2792 E72.tmp 2084 ED0.tmp 1592 F3D.tmp 572 FAA.tmp 2076 1017.tmp 1292 1084.tmp 2180 10E2.tmp 2028 1140.tmp 2068 11BC.tmp 2308 120A.tmp 3004 1287.tmp 2892 12E5.tmp 2540 1342.tmp 2616 13B0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1292 2276 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 30 PID 2276 wrote to memory of 1292 2276 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 30 PID 2276 wrote to memory of 1292 2276 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 30 PID 2276 wrote to memory of 1292 2276 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 30 PID 1292 wrote to memory of 924 1292 F103.tmp 31 PID 1292 wrote to memory of 924 1292 F103.tmp 31 PID 1292 wrote to memory of 924 1292 F103.tmp 31 PID 1292 wrote to memory of 924 1292 F103.tmp 31 PID 924 wrote to memory of 2068 924 F1BE.tmp 32 PID 924 wrote to memory of 2068 924 F1BE.tmp 32 PID 924 wrote to memory of 2068 924 F1BE.tmp 32 PID 924 wrote to memory of 2068 924 F1BE.tmp 32 PID 2068 wrote to memory of 3004 2068 F2D7.tmp 33 PID 2068 wrote to memory of 3004 2068 F2D7.tmp 33 PID 2068 wrote to memory of 3004 2068 F2D7.tmp 33 PID 2068 wrote to memory of 3004 2068 F2D7.tmp 33 PID 3004 wrote to memory of 2908 3004 F3B2.tmp 34 PID 3004 wrote to memory of 2908 3004 F3B2.tmp 34 PID 3004 wrote to memory of 2908 3004 F3B2.tmp 34 PID 3004 wrote to memory of 2908 3004 F3B2.tmp 34 PID 2908 wrote to memory of 2948 2908 F45D.tmp 35 PID 2908 wrote to memory of 2948 2908 F45D.tmp 35 PID 2908 wrote to memory of 2948 2908 F45D.tmp 35 PID 2908 wrote to memory of 2948 2908 F45D.tmp 35 PID 2948 wrote to memory of 2600 2948 F509.tmp 36 PID 2948 wrote to memory of 2600 2948 F509.tmp 36 PID 2948 wrote to memory of 2600 2948 F509.tmp 36 PID 2948 wrote to memory of 2600 2948 F509.tmp 36 PID 2600 wrote to memory of 2604 2600 F5D4.tmp 37 PID 2600 wrote to memory of 2604 2600 F5D4.tmp 37 PID 2600 wrote to memory of 2604 2600 F5D4.tmp 37 PID 2600 wrote to memory of 2604 2600 F5D4.tmp 37 PID 2604 wrote to memory of 2764 2604 F69E.tmp 38 PID 2604 wrote to memory of 2764 2604 F69E.tmp 38 PID 2604 wrote to memory of 2764 2604 F69E.tmp 38 PID 2604 wrote to memory of 2764 2604 F69E.tmp 38 PID 2764 wrote to memory of 2924 2764 F75A.tmp 39 PID 2764 wrote to memory of 2924 2764 F75A.tmp 39 PID 2764 wrote to memory of 2924 2764 F75A.tmp 39 PID 2764 wrote to memory of 2924 2764 F75A.tmp 39 PID 2924 wrote to memory of 2500 2924 F7F6.tmp 40 PID 2924 wrote to memory of 2500 2924 F7F6.tmp 40 PID 2924 wrote to memory of 2500 2924 F7F6.tmp 40 PID 2924 wrote to memory of 2500 2924 F7F6.tmp 40 PID 2500 wrote to memory of 2460 2500 F8B1.tmp 41 PID 2500 wrote to memory of 2460 2500 F8B1.tmp 41 PID 2500 wrote to memory of 2460 2500 F8B1.tmp 41 PID 2500 wrote to memory of 2460 2500 F8B1.tmp 41 PID 2460 wrote to memory of 2424 2460 F98B.tmp 42 PID 2460 wrote to memory of 2424 2460 F98B.tmp 42 PID 2460 wrote to memory of 2424 2460 F98B.tmp 42 PID 2460 wrote to memory of 2424 2460 F98B.tmp 42 PID 2424 wrote to memory of 1772 2424 FA37.tmp 43 PID 2424 wrote to memory of 1772 2424 FA37.tmp 43 PID 2424 wrote to memory of 1772 2424 FA37.tmp 43 PID 2424 wrote to memory of 1772 2424 FA37.tmp 43 PID 1772 wrote to memory of 2848 1772 FAD3.tmp 44 PID 1772 wrote to memory of 2848 1772 FAD3.tmp 44 PID 1772 wrote to memory of 2848 1772 FAD3.tmp 44 PID 1772 wrote to memory of 2848 1772 FAD3.tmp 44 PID 2848 wrote to memory of 1920 2848 FB8E.tmp 45 PID 2848 wrote to memory of 1920 2848 FB8E.tmp 45 PID 2848 wrote to memory of 1920 2848 FB8E.tmp 45 PID 2848 wrote to memory of 1920 2848 FB8E.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\F69E.tmp"C:\Users\Admin\AppData\Local\Temp\F69E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\FA37.tmp"C:\Users\Admin\AppData\Local\Temp\FA37.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"C:\Users\Admin\AppData\Local\Temp\FDC0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\10.tmp"C:\Users\Admin\AppData\Local\Temp\10.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\242.tmp"C:\Users\Admin\AppData\Local\Temp\242.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\2A0.tmp"C:\Users\Admin\AppData\Local\Temp\2A0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\2FD.tmp"C:\Users\Admin\AppData\Local\Temp\2FD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\56D.tmp"C:\Users\Admin\AppData\Local\Temp\56D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\5CB.tmp"C:\Users\Admin\AppData\Local\Temp\5CB.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\982.tmp"C:\Users\Admin\AppData\Local\Temp\982.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\A4D.tmp"C:\Users\Admin\AppData\Local\Temp\A4D.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\1084.tmp"C:\Users\Admin\AppData\Local\Temp\1084.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\141D.tmp"C:\Users\Admin\AppData\Local\Temp\141D.tmp"65⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"67⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1593.tmp"C:\Users\Admin\AppData\Local\Temp\1593.tmp"68⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\1600.tmp"C:\Users\Admin\AppData\Local\Temp\1600.tmp"69⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"70⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"71⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"72⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"74⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"75⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"76⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"77⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"78⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"C:\Users\Admin\AppData\Local\Temp\1AD1.tmp"79⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"C:\Users\Admin\AppData\Local\Temp\1B2E.tmp"80⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"81⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"82⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"83⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"84⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"85⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"86⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\1F92.tmp"C:\Users\Admin\AppData\Local\Temp\1F92.tmp"88⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"89⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\209B.tmp"C:\Users\Admin\AppData\Local\Temp\209B.tmp"90⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"91⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"92⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\21D3.tmp"C:\Users\Admin\AppData\Local\Temp\21D3.tmp"93⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"94⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"95⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"96⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"97⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"98⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"99⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"100⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"101⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"102⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"103⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"104⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\26F1.tmp"C:\Users\Admin\AppData\Local\Temp\26F1.tmp"105⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"106⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"107⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"108⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"109⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"110⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"111⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"112⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"113⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"114⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"115⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"116⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"C:\Users\Admin\AppData\Local\Temp\2C1F.tmp"117⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"118⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\2D76.tmp"C:\Users\Admin\AppData\Local\Temp\2D76.tmp"119⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"120⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"121⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"122⤵PID:1292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-