Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30/09/2023, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
-
Size
488KB
-
MD5
e1c1534057c0e96a9f4e618e970e1890
-
SHA1
c1b6f18c95004822fd13b1f03d320d76ed252dc6
-
SHA256
3ccfb5c9bd311850ba5bbbbd56446bccc7617aa5764966029070bd52bfa1e20f
-
SHA512
ed2b11c491bd353624eb317912652da7d53a41dbcf8daaa09c2ca05795eec72280575fecc1e6b2091626e0d8369ddb15a771bc360d1bdc8f373cb2f7490c1c8a
-
SSDEEP
12288:/U5rCOTeiD0UKtvjEoLqwGg8Vpux9ONZ:/UQOJD0JtvjLLqJJpGON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2020 280A.tmp 2704 28B6.tmp 1084 2980.tmp 1928 2A5B.tmp 2748 2B54.tmp 2784 2C3E.tmp 2944 2D19.tmp 2852 2DE4.tmp 2688 2EAE.tmp 2536 2F79.tmp 1828 3044.tmp 2372 30FF.tmp 1668 31BA.tmp 3004 32A4.tmp 1196 337F.tmp 2304 3498.tmp 1568 3572.tmp 2624 362D.tmp 1976 36E8.tmp 1916 3794.tmp 2900 385F.tmp 1424 3A23.tmp 1528 3AEE.tmp 1768 3BA9.tmp 1728 3C26.tmp 1224 3CA3.tmp 2092 3D20.tmp 2964 3DAC.tmp 2344 3E0A.tmp 2104 3E77.tmp 568 3EF4.tmp 772 3F70.tmp 1508 3FED.tmp 1616 406A.tmp 1260 40F6.tmp 2144 4173.tmp 2208 41E0.tmp 2604 426D.tmp 2792 4309.tmp 1104 4395.tmp 304 4412.tmp 1988 448F.tmp 1604 450C.tmp 1036 4588.tmp 1064 45F6.tmp 1068 4682.tmp 2264 46FF.tmp 1536 476C.tmp 1820 47E9.tmp 2164 4856.tmp 1340 48D3.tmp 1252 4950.tmp 1612 49AD.tmp 2228 4A1A.tmp 2132 4A88.tmp 1560 4AF5.tmp 1588 4B72.tmp 1240 4BDF.tmp 2360 4C6B.tmp 2788 4CE8.tmp 1084 4D55.tmp 2668 4DC2.tmp 2672 4F68.tmp 2740 5023.tmp -
Loads dropped DLL 64 IoCs
pid Process 1328 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 2020 280A.tmp 2704 28B6.tmp 1084 2980.tmp 1928 2A5B.tmp 2748 2B54.tmp 2784 2C3E.tmp 2944 2D19.tmp 2852 2DE4.tmp 2688 2EAE.tmp 2536 2F79.tmp 1828 3044.tmp 2372 30FF.tmp 1668 31BA.tmp 3004 32A4.tmp 1196 337F.tmp 2304 3498.tmp 1568 3572.tmp 2624 362D.tmp 1976 36E8.tmp 1916 3794.tmp 2900 385F.tmp 1424 3A23.tmp 1528 3AEE.tmp 1768 3BA9.tmp 1728 3C26.tmp 1224 3CA3.tmp 2092 3D20.tmp 2964 3DAC.tmp 2344 3E0A.tmp 2104 3E77.tmp 568 3EF4.tmp 772 3F70.tmp 1508 3FED.tmp 1616 406A.tmp 1260 40F6.tmp 2144 4173.tmp 2208 41E0.tmp 2604 426D.tmp 2792 4309.tmp 1104 4395.tmp 304 4412.tmp 1988 448F.tmp 1604 450C.tmp 1036 4588.tmp 1064 45F6.tmp 1068 4682.tmp 2264 46FF.tmp 1536 476C.tmp 1820 47E9.tmp 2164 4856.tmp 1340 48D3.tmp 1252 4950.tmp 1612 49AD.tmp 2228 4A1A.tmp 2132 4A88.tmp 1560 4AF5.tmp 1588 4B72.tmp 1240 4BDF.tmp 2360 4C6B.tmp 2788 4CE8.tmp 1084 4D55.tmp 2668 4DC2.tmp 2672 4F68.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1328 wrote to memory of 2020 1328 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 28 PID 1328 wrote to memory of 2020 1328 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 28 PID 1328 wrote to memory of 2020 1328 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 28 PID 1328 wrote to memory of 2020 1328 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 28 PID 2020 wrote to memory of 2704 2020 280A.tmp 29 PID 2020 wrote to memory of 2704 2020 280A.tmp 29 PID 2020 wrote to memory of 2704 2020 280A.tmp 29 PID 2020 wrote to memory of 2704 2020 280A.tmp 29 PID 2704 wrote to memory of 1084 2704 28B6.tmp 30 PID 2704 wrote to memory of 1084 2704 28B6.tmp 30 PID 2704 wrote to memory of 1084 2704 28B6.tmp 30 PID 2704 wrote to memory of 1084 2704 28B6.tmp 30 PID 1084 wrote to memory of 1928 1084 2980.tmp 31 PID 1084 wrote to memory of 1928 1084 2980.tmp 31 PID 1084 wrote to memory of 1928 1084 2980.tmp 31 PID 1084 wrote to memory of 1928 1084 2980.tmp 31 PID 1928 wrote to memory of 2748 1928 2A5B.tmp 32 PID 1928 wrote to memory of 2748 1928 2A5B.tmp 32 PID 1928 wrote to memory of 2748 1928 2A5B.tmp 32 PID 1928 wrote to memory of 2748 1928 2A5B.tmp 32 PID 2748 wrote to memory of 2784 2748 2B54.tmp 33 PID 2748 wrote to memory of 2784 2748 2B54.tmp 33 PID 2748 wrote to memory of 2784 2748 2B54.tmp 33 PID 2748 wrote to memory of 2784 2748 2B54.tmp 33 PID 2784 wrote to memory of 2944 2784 2C3E.tmp 34 PID 2784 wrote to memory of 2944 2784 2C3E.tmp 34 PID 2784 wrote to memory of 2944 2784 2C3E.tmp 34 PID 2784 wrote to memory of 2944 2784 2C3E.tmp 34 PID 2944 wrote to memory of 2852 2944 2D19.tmp 35 PID 2944 wrote to memory of 2852 2944 2D19.tmp 35 PID 2944 wrote to memory of 2852 2944 2D19.tmp 35 PID 2944 wrote to memory of 2852 2944 2D19.tmp 35 PID 2852 wrote to memory of 2688 2852 2DE4.tmp 36 PID 2852 wrote to memory of 2688 2852 2DE4.tmp 36 PID 2852 wrote to memory of 2688 2852 2DE4.tmp 36 PID 2852 wrote to memory of 2688 2852 2DE4.tmp 36 PID 2688 wrote to memory of 2536 2688 2EAE.tmp 37 PID 2688 wrote to memory of 2536 2688 2EAE.tmp 37 PID 2688 wrote to memory of 2536 2688 2EAE.tmp 37 PID 2688 wrote to memory of 2536 2688 2EAE.tmp 37 PID 2536 wrote to memory of 1828 2536 2F79.tmp 38 PID 2536 wrote to memory of 1828 2536 2F79.tmp 38 PID 2536 wrote to memory of 1828 2536 2F79.tmp 38 PID 2536 wrote to memory of 1828 2536 2F79.tmp 38 PID 1828 wrote to memory of 2372 1828 3044.tmp 39 PID 1828 wrote to memory of 2372 1828 3044.tmp 39 PID 1828 wrote to memory of 2372 1828 3044.tmp 39 PID 1828 wrote to memory of 2372 1828 3044.tmp 39 PID 2372 wrote to memory of 1668 2372 30FF.tmp 40 PID 2372 wrote to memory of 1668 2372 30FF.tmp 40 PID 2372 wrote to memory of 1668 2372 30FF.tmp 40 PID 2372 wrote to memory of 1668 2372 30FF.tmp 40 PID 1668 wrote to memory of 3004 1668 31BA.tmp 41 PID 1668 wrote to memory of 3004 1668 31BA.tmp 41 PID 1668 wrote to memory of 3004 1668 31BA.tmp 41 PID 1668 wrote to memory of 3004 1668 31BA.tmp 41 PID 3004 wrote to memory of 1196 3004 32A4.tmp 42 PID 3004 wrote to memory of 1196 3004 32A4.tmp 42 PID 3004 wrote to memory of 1196 3004 32A4.tmp 42 PID 3004 wrote to memory of 1196 3004 32A4.tmp 42 PID 1196 wrote to memory of 2304 1196 337F.tmp 43 PID 1196 wrote to memory of 2304 1196 337F.tmp 43 PID 1196 wrote to memory of 2304 1196 337F.tmp 43 PID 1196 wrote to memory of 2304 1196 337F.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"C:\Users\Admin\AppData\Local\Temp\2EAE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3044.tmp"C:\Users\Admin\AppData\Local\Temp\3044.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\30FF.tmp"C:\Users\Admin\AppData\Local\Temp\30FF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\3794.tmp"C:\Users\Admin\AppData\Local\Temp\3794.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"C:\Users\Admin\AppData\Local\Temp\3BA9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\3E77.tmp"C:\Users\Admin\AppData\Local\Temp\3E77.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"C:\Users\Admin\AppData\Local\Temp\3EF4.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\40F6.tmp"C:\Users\Admin\AppData\Local\Temp\40F6.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\4173.tmp"C:\Users\Admin\AppData\Local\Temp\4173.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\426D.tmp"C:\Users\Admin\AppData\Local\Temp\426D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\4309.tmp"C:\Users\Admin\AppData\Local\Temp\4309.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\4395.tmp"C:\Users\Admin\AppData\Local\Temp\4395.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\448F.tmp"C:\Users\Admin\AppData\Local\Temp\448F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\450C.tmp"C:\Users\Admin\AppData\Local\Temp\450C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4588.tmp"C:\Users\Admin\AppData\Local\Temp\4588.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\46FF.tmp"C:\Users\Admin\AppData\Local\Temp\46FF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\476C.tmp"C:\Users\Admin\AppData\Local\Temp\476C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\47E9.tmp"C:\Users\Admin\AppData\Local\Temp\47E9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\4856.tmp"C:\Users\Admin\AppData\Local\Temp\4856.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\48D3.tmp"C:\Users\Admin\AppData\Local\Temp\48D3.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"C:\Users\Admin\AppData\Local\Temp\4BDF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"65⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5090.tmp"C:\Users\Admin\AppData\Local\Temp\5090.tmp"66⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"67⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"68⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"69⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"70⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"71⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"72⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"73⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"74⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\54A5.tmp"C:\Users\Admin\AppData\Local\Temp\54A5.tmp"75⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"76⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5580.tmp"C:\Users\Admin\AppData\Local\Temp\5580.tmp"77⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\55FC.tmp"C:\Users\Admin\AppData\Local\Temp\55FC.tmp"78⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\5679.tmp"C:\Users\Admin\AppData\Local\Temp\5679.tmp"79⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"80⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"81⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"82⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"83⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"84⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"85⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"86⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"87⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"88⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"89⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5B78.tmp"C:\Users\Admin\AppData\Local\Temp\5B78.tmp"90⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"91⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"92⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"93⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"94⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"95⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"96⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"97⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"C:\Users\Admin\AppData\Local\Temp\5ED2.tmp"98⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"99⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"100⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"101⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"102⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\6190.tmp"C:\Users\Admin\AppData\Local\Temp\6190.tmp"104⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"105⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"106⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"107⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"108⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"109⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"110⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"111⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"112⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"113⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"114⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"115⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\673B.tmp"C:\Users\Admin\AppData\Local\Temp\673B.tmp"116⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"117⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"118⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"119⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\68D1.tmp"C:\Users\Admin\AppData\Local\Temp\68D1.tmp"120⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\692F.tmp"C:\Users\Admin\AppData\Local\Temp\692F.tmp"121⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"122⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-