Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/09/2023, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe
-
Size
486KB
-
MD5
18e20458e50a198019894daa6a143556
-
SHA1
3534570b3c696cc6fa2e5dcaa828847727b1393a
-
SHA256
fc3517877045f0663a41a470f852844419d65208f5c90ea8b84d0c9c4f742031
-
SHA512
bd4949f0041b2b08dc83c70ee7580271aae9277aa9f502887755d62746f644bdc9139c95edd4fb70af304f1738debc5834eea46671142ffb5210f41f50aed6d9
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7GTShVWGQ+ttA/3iVim3xV638EAKCNmkHRHQ:/U5rCOTeiDGmGGhHfC3pAKApthNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2292 5E94.tmp 2676 5F01.tmp 2592 600A.tmp 2768 6123.tmp 2628 624C.tmp 2492 6355.tmp 2084 643F.tmp 2620 6548.tmp 2740 6632.tmp 2556 673B.tmp 2776 6873.tmp 2464 696D.tmp 268 6A38.tmp 584 6B12.tmp 1244 6BDD.tmp 1724 6D25.tmp 2704 6E1E.tmp 2572 6EF9.tmp 2816 707F.tmp 740 7197.tmp 844 7272.tmp 1952 735C.tmp 1532 7427.tmp 1800 74B3.tmp 992 753F.tmp 2844 75CC.tmp 1616 7649.tmp 112 76E5.tmp 2868 7771.tmp 2148 77EE.tmp 1700 787A.tmp 1280 7907.tmp 2128 7993.tmp 2372 7A1F.tmp 628 7A8D.tmp 2296 7B19.tmp 612 7BA5.tmp 2324 7C51.tmp 2276 7CED.tmp 1772 7D5A.tmp 1748 7E06.tmp 1320 7E92.tmp 948 7F0F.tmp 1148 7F8C.tmp 1672 8018.tmp 1284 80A5.tmp 836 8112.tmp 1500 816F.tmp 924 81EC.tmp 1924 8259.tmp 856 82F5.tmp 2204 8382.tmp 2956 83FF.tmp 3028 846C.tmp 2896 84D9.tmp 1576 85D3.tmp 2036 8640.tmp 3032 86FB.tmp 1648 8768.tmp 2124 87D5.tmp 2752 8843.tmp 2784 88B0.tmp 2772 891D.tmp 2416 897B.tmp -
Loads dropped DLL 64 IoCs
pid Process 1612 2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe 2292 5E94.tmp 2676 5F01.tmp 2592 600A.tmp 2768 6123.tmp 2628 624C.tmp 2492 6355.tmp 2084 643F.tmp 2620 6548.tmp 2740 6632.tmp 2556 673B.tmp 2776 6873.tmp 2464 696D.tmp 268 6A38.tmp 584 6B12.tmp 1244 6BDD.tmp 1724 6D25.tmp 2704 6E1E.tmp 2572 6EF9.tmp 2816 707F.tmp 740 7197.tmp 844 7272.tmp 1952 735C.tmp 1532 7427.tmp 1800 74B3.tmp 992 753F.tmp 2844 75CC.tmp 1616 7649.tmp 112 76E5.tmp 2868 7771.tmp 2148 77EE.tmp 1700 787A.tmp 1280 7907.tmp 2128 7993.tmp 2372 7A1F.tmp 628 7A8D.tmp 2296 7B19.tmp 612 7BA5.tmp 2324 7C51.tmp 2276 7CED.tmp 1772 7D5A.tmp 1748 7E06.tmp 1320 7E92.tmp 948 7F0F.tmp 1148 7F8C.tmp 1672 8018.tmp 1284 80A5.tmp 836 8112.tmp 1500 816F.tmp 924 81EC.tmp 1924 8259.tmp 856 82F5.tmp 2204 8382.tmp 2956 83FF.tmp 3028 846C.tmp 2896 84D9.tmp 1576 85D3.tmp 2036 8640.tmp 3032 86FB.tmp 1648 8768.tmp 2124 87D5.tmp 2752 8843.tmp 2784 88B0.tmp 2772 891D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2292 1612 2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe 28 PID 1612 wrote to memory of 2292 1612 2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe 28 PID 1612 wrote to memory of 2292 1612 2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe 28 PID 1612 wrote to memory of 2292 1612 2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe 28 PID 2292 wrote to memory of 2676 2292 5E94.tmp 29 PID 2292 wrote to memory of 2676 2292 5E94.tmp 29 PID 2292 wrote to memory of 2676 2292 5E94.tmp 29 PID 2292 wrote to memory of 2676 2292 5E94.tmp 29 PID 2676 wrote to memory of 2592 2676 5F01.tmp 30 PID 2676 wrote to memory of 2592 2676 5F01.tmp 30 PID 2676 wrote to memory of 2592 2676 5F01.tmp 30 PID 2676 wrote to memory of 2592 2676 5F01.tmp 30 PID 2592 wrote to memory of 2768 2592 600A.tmp 31 PID 2592 wrote to memory of 2768 2592 600A.tmp 31 PID 2592 wrote to memory of 2768 2592 600A.tmp 31 PID 2592 wrote to memory of 2768 2592 600A.tmp 31 PID 2768 wrote to memory of 2628 2768 6123.tmp 32 PID 2768 wrote to memory of 2628 2768 6123.tmp 32 PID 2768 wrote to memory of 2628 2768 6123.tmp 32 PID 2768 wrote to memory of 2628 2768 6123.tmp 32 PID 2628 wrote to memory of 2492 2628 624C.tmp 33 PID 2628 wrote to memory of 2492 2628 624C.tmp 33 PID 2628 wrote to memory of 2492 2628 624C.tmp 33 PID 2628 wrote to memory of 2492 2628 624C.tmp 33 PID 2492 wrote to memory of 2084 2492 6355.tmp 34 PID 2492 wrote to memory of 2084 2492 6355.tmp 34 PID 2492 wrote to memory of 2084 2492 6355.tmp 34 PID 2492 wrote to memory of 2084 2492 6355.tmp 34 PID 2084 wrote to memory of 2620 2084 643F.tmp 35 PID 2084 wrote to memory of 2620 2084 643F.tmp 35 PID 2084 wrote to memory of 2620 2084 643F.tmp 35 PID 2084 wrote to memory of 2620 2084 643F.tmp 35 PID 2620 wrote to memory of 2740 2620 6548.tmp 36 PID 2620 wrote to memory of 2740 2620 6548.tmp 36 PID 2620 wrote to memory of 2740 2620 6548.tmp 36 PID 2620 wrote to memory of 2740 2620 6548.tmp 36 PID 2740 wrote to memory of 2556 2740 6632.tmp 37 PID 2740 wrote to memory of 2556 2740 6632.tmp 37 PID 2740 wrote to memory of 2556 2740 6632.tmp 37 PID 2740 wrote to memory of 2556 2740 6632.tmp 37 PID 2556 wrote to memory of 2776 2556 673B.tmp 38 PID 2556 wrote to memory of 2776 2556 673B.tmp 38 PID 2556 wrote to memory of 2776 2556 673B.tmp 38 PID 2556 wrote to memory of 2776 2556 673B.tmp 38 PID 2776 wrote to memory of 2464 2776 6873.tmp 39 PID 2776 wrote to memory of 2464 2776 6873.tmp 39 PID 2776 wrote to memory of 2464 2776 6873.tmp 39 PID 2776 wrote to memory of 2464 2776 6873.tmp 39 PID 2464 wrote to memory of 268 2464 696D.tmp 40 PID 2464 wrote to memory of 268 2464 696D.tmp 40 PID 2464 wrote to memory of 268 2464 696D.tmp 40 PID 2464 wrote to memory of 268 2464 696D.tmp 40 PID 268 wrote to memory of 584 268 6A38.tmp 41 PID 268 wrote to memory of 584 268 6A38.tmp 41 PID 268 wrote to memory of 584 268 6A38.tmp 41 PID 268 wrote to memory of 584 268 6A38.tmp 41 PID 584 wrote to memory of 1244 584 6B12.tmp 42 PID 584 wrote to memory of 1244 584 6B12.tmp 42 PID 584 wrote to memory of 1244 584 6B12.tmp 42 PID 584 wrote to memory of 1244 584 6B12.tmp 42 PID 1244 wrote to memory of 1724 1244 6BDD.tmp 43 PID 1244 wrote to memory of 1724 1244 6BDD.tmp 43 PID 1244 wrote to memory of 1724 1244 6BDD.tmp 43 PID 1244 wrote to memory of 1724 1244 6BDD.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_18e20458e50a198019894daa6a143556_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\600A.tmp"C:\Users\Admin\AppData\Local\Temp\600A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"C:\Users\Admin\AppData\Local\Temp\6BDD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"C:\Users\Admin\AppData\Local\Temp\6E1E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7197.tmp"C:\Users\Admin\AppData\Local\Temp\7197.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:740 -
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\7427.tmp"C:\Users\Admin\AppData\Local\Temp\7427.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:112 -
C:\Users\Admin\AppData\Local\Temp\7771.tmp"C:\Users\Admin\AppData\Local\Temp\7771.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\77EE.tmp"C:\Users\Admin\AppData\Local\Temp\77EE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"C:\Users\Admin\AppData\Local\Temp\7A1F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"C:\Users\Admin\AppData\Local\Temp\7A8D.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7B19.tmp"C:\Users\Admin\AppData\Local\Temp\7B19.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"C:\Users\Admin\AppData\Local\Temp\7D5A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\80A5.tmp"C:\Users\Admin\AppData\Local\Temp\80A5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\85D3.tmp"C:\Users\Admin\AppData\Local\Temp\85D3.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8843.tmp"C:\Users\Admin\AppData\Local\Temp\8843.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\891D.tmp"C:\Users\Admin\AppData\Local\Temp\891D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\897B.tmp"C:\Users\Admin\AppData\Local\Temp\897B.tmp"65⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"66⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"67⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"68⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"69⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"70⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"72⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"74⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"75⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"76⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"77⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"78⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"79⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"80⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"81⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"82⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"83⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"84⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"85⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"86⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"87⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"88⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"89⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"90⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"91⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"92⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"93⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"94⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"95⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"96⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"97⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"98⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"99⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"100⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"101⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"102⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"103⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"104⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"C:\Users\Admin\AppData\Local\Temp\9DC5.tmp"105⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"106⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"107⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"108⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"C:\Users\Admin\AppData\Local\Temp\9FC8.tmp"109⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A035.tmp"C:\Users\Admin\AppData\Local\Temp\A035.tmp"110⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"C:\Users\Admin\AppData\Local\Temp\A0A3.tmp"111⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"112⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A19C.tmp"C:\Users\Admin\AppData\Local\Temp\A19C.tmp"113⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"114⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"C:\Users\Admin\AppData\Local\Temp\A2A5.tmp"115⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"116⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"117⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"119⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"120⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-