Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/08/2023, 17:51
Static task
static1
Behavioral task
behavioral1
Sample
b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe
-
Size
486KB
-
MD5
b8144a7a2dc026fa26ca6b2933f7c20b
-
SHA1
229fea305cde2d93c1037e43511741e6756ef0d2
-
SHA256
906c174f3ec6adfcd9cbe38117ec450fe99b94a22a763d9ea3122be153654841
-
SHA512
4f61c06948f95c6299d74c7ab2eb837eb15fcb5ec6c5bf3ac93109437cde2c6f0bbacfd1045f434f9754f64bdcbc074f583acd42a286443ba348052dbc052a70
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7DnOHXbUuAZ0voKIgK/Wrdywh6WkoXU8q8c/a:oU5rCOTeiDD+PAZ0IDWxLU6VNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2336 7D0C.tmp 2528 7D99.tmp 2860 7E54.tmp 2960 7F6D.tmp 1088 8066.tmp 2936 8102.tmp 2568 81BD.tmp 2452 8298.tmp 2768 83A1.tmp 2760 845C.tmp 2268 8527.tmp 2344 8611.tmp 780 86AD.tmp 556 8759.tmp 600 8814.tmp 992 88DF.tmp 2096 897B.tmp 1668 8A36.tmp 892 8B10.tmp 816 8BDB.tmp 2788 8CA6.tmp 3068 8D61.tmp 2144 8E0D.tmp 2260 8F64.tmp 1628 8FF0.tmp 1212 908C.tmp 2688 90F9.tmp 1108 9157.tmp 2152 91D4.tmp 1992 9260.tmp 2040 92CD.tmp 2176 934A.tmp 2544 9398.tmp 1948 9405.tmp 1348 9482.tmp 2216 950F.tmp 2480 958B.tmp 1164 9608.tmp 1928 9675.tmp 1684 96F2.tmp 1372 975F.tmp 2548 97DC.tmp 1532 9849.tmp 1488 98D6.tmp 2820 9933.tmp 1016 99B0.tmp 2508 9A1D.tmp 768 9A7B.tmp 2600 9AD9.tmp 576 9B46.tmp 2316 9BB3.tmp 1964 9C30.tmp 2304 9C9D.tmp 2596 9CEB.tmp 2680 9D58.tmp 3016 9E23.tmp 2468 9E90.tmp 2068 9EFD.tmp 1304 9F7A.tmp 2848 9FE7.tmp 2872 A064.tmp 2828 A0D1.tmp 3008 A13F.tmp 2836 A1BB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2472 b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe 2336 7D0C.tmp 2528 7D99.tmp 2860 7E54.tmp 2960 7F6D.tmp 1088 8066.tmp 2936 8102.tmp 2568 81BD.tmp 2452 8298.tmp 2768 83A1.tmp 2760 845C.tmp 2268 8527.tmp 2344 8611.tmp 780 86AD.tmp 556 8759.tmp 600 8814.tmp 992 88DF.tmp 2096 897B.tmp 1668 8A36.tmp 892 8B10.tmp 816 8BDB.tmp 2788 8CA6.tmp 3068 8D61.tmp 2144 8E0D.tmp 2260 8F64.tmp 1628 8FF0.tmp 1212 908C.tmp 2688 90F9.tmp 1108 9157.tmp 2152 91D4.tmp 1992 9260.tmp 2040 92CD.tmp 2176 934A.tmp 2544 9398.tmp 1948 9405.tmp 1348 9482.tmp 2216 950F.tmp 2480 958B.tmp 1164 9608.tmp 1928 9675.tmp 1684 96F2.tmp 1372 975F.tmp 2548 97DC.tmp 1532 9849.tmp 1488 98D6.tmp 2820 9933.tmp 1016 99B0.tmp 2508 9A1D.tmp 768 9A7B.tmp 2600 9AD9.tmp 576 9B46.tmp 2316 9BB3.tmp 1964 9C30.tmp 2304 9C9D.tmp 2596 9CEB.tmp 2472 9DC5.tmp 3016 9E23.tmp 2468 9E90.tmp 2068 9EFD.tmp 1304 9F7A.tmp 2848 9FE7.tmp 2872 A064.tmp 2828 A0D1.tmp 3008 A13F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2336 2472 b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe 28 PID 2472 wrote to memory of 2336 2472 b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe 28 PID 2472 wrote to memory of 2336 2472 b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe 28 PID 2472 wrote to memory of 2336 2472 b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe 28 PID 2336 wrote to memory of 2528 2336 7D0C.tmp 29 PID 2336 wrote to memory of 2528 2336 7D0C.tmp 29 PID 2336 wrote to memory of 2528 2336 7D0C.tmp 29 PID 2336 wrote to memory of 2528 2336 7D0C.tmp 29 PID 2528 wrote to memory of 2860 2528 7D99.tmp 30 PID 2528 wrote to memory of 2860 2528 7D99.tmp 30 PID 2528 wrote to memory of 2860 2528 7D99.tmp 30 PID 2528 wrote to memory of 2860 2528 7D99.tmp 30 PID 2860 wrote to memory of 2960 2860 7E54.tmp 31 PID 2860 wrote to memory of 2960 2860 7E54.tmp 31 PID 2860 wrote to memory of 2960 2860 7E54.tmp 31 PID 2860 wrote to memory of 2960 2860 7E54.tmp 31 PID 2960 wrote to memory of 1088 2960 7F6D.tmp 32 PID 2960 wrote to memory of 1088 2960 7F6D.tmp 32 PID 2960 wrote to memory of 1088 2960 7F6D.tmp 32 PID 2960 wrote to memory of 1088 2960 7F6D.tmp 32 PID 1088 wrote to memory of 2936 1088 8066.tmp 33 PID 1088 wrote to memory of 2936 1088 8066.tmp 33 PID 1088 wrote to memory of 2936 1088 8066.tmp 33 PID 1088 wrote to memory of 2936 1088 8066.tmp 33 PID 2936 wrote to memory of 2568 2936 8102.tmp 34 PID 2936 wrote to memory of 2568 2936 8102.tmp 34 PID 2936 wrote to memory of 2568 2936 8102.tmp 34 PID 2936 wrote to memory of 2568 2936 8102.tmp 34 PID 2568 wrote to memory of 2452 2568 81BD.tmp 35 PID 2568 wrote to memory of 2452 2568 81BD.tmp 35 PID 2568 wrote to memory of 2452 2568 81BD.tmp 35 PID 2568 wrote to memory of 2452 2568 81BD.tmp 35 PID 2452 wrote to memory of 2768 2452 8298.tmp 36 PID 2452 wrote to memory of 2768 2452 8298.tmp 36 PID 2452 wrote to memory of 2768 2452 8298.tmp 36 PID 2452 wrote to memory of 2768 2452 8298.tmp 36 PID 2768 wrote to memory of 2760 2768 83A1.tmp 37 PID 2768 wrote to memory of 2760 2768 83A1.tmp 37 PID 2768 wrote to memory of 2760 2768 83A1.tmp 37 PID 2768 wrote to memory of 2760 2768 83A1.tmp 37 PID 2760 wrote to memory of 2268 2760 845C.tmp 38 PID 2760 wrote to memory of 2268 2760 845C.tmp 38 PID 2760 wrote to memory of 2268 2760 845C.tmp 38 PID 2760 wrote to memory of 2268 2760 845C.tmp 38 PID 2268 wrote to memory of 2344 2268 8527.tmp 39 PID 2268 wrote to memory of 2344 2268 8527.tmp 39 PID 2268 wrote to memory of 2344 2268 8527.tmp 39 PID 2268 wrote to memory of 2344 2268 8527.tmp 39 PID 2344 wrote to memory of 780 2344 8611.tmp 40 PID 2344 wrote to memory of 780 2344 8611.tmp 40 PID 2344 wrote to memory of 780 2344 8611.tmp 40 PID 2344 wrote to memory of 780 2344 8611.tmp 40 PID 780 wrote to memory of 556 780 86AD.tmp 41 PID 780 wrote to memory of 556 780 86AD.tmp 41 PID 780 wrote to memory of 556 780 86AD.tmp 41 PID 780 wrote to memory of 556 780 86AD.tmp 41 PID 556 wrote to memory of 600 556 8759.tmp 42 PID 556 wrote to memory of 600 556 8759.tmp 42 PID 556 wrote to memory of 600 556 8759.tmp 42 PID 556 wrote to memory of 600 556 8759.tmp 42 PID 600 wrote to memory of 992 600 8814.tmp 43 PID 600 wrote to memory of 992 600 8814.tmp 43 PID 600 wrote to memory of 992 600 8814.tmp 43 PID 600 wrote to memory of 992 600 8814.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b8144a7a2dc026fa26ca6b2933f7c20b_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8611.tmp"C:\Users\Admin\AppData\Local\Temp\8611.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\92CD.tmp"C:\Users\Admin\AppData\Local\Temp\92CD.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\9405.tmp"C:\Users\Admin\AppData\Local\Temp\9405.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:768 -
C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"C:\Users\Admin\AppData\Local\Temp\9AD9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"56⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"57⤵
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"C:\Users\Admin\AppData\Local\Temp\9F7A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"66⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A229.tmp"C:\Users\Admin\AppData\Local\Temp\A229.tmp"67⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"68⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\A313.tmp"C:\Users\Admin\AppData\Local\Temp\A313.tmp"69⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"70⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"71⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"72⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"73⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"74⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"75⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"76⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\A795.tmp"C:\Users\Admin\AppData\Local\Temp\A795.tmp"77⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"78⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"79⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"80⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"81⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"82⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"83⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\AA91.tmp"C:\Users\Admin\AppData\Local\Temp\AA91.tmp"84⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"85⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"C:\Users\Admin\AppData\Local\Temp\AB7B.tmp"86⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"87⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"88⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"89⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\AD30.tmp"C:\Users\Admin\AppData\Local\Temp\AD30.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"91⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"92⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"93⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"94⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"95⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"96⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"97⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"98⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"99⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"100⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"101⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"102⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"103⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"104⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"105⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"106⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"107⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"108⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"109⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"110⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"111⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"112⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"113⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"114⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"115⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"116⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"117⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"118⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"119⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"120⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"C:\Users\Admin\AppData\Local\Temp\BAE6.tmp"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-