Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
02/10/2023, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe
-
Size
520KB
-
MD5
53c55f2a4e4a1ac05e518cf4f9be0df7
-
SHA1
d6ccc9f5517edef31c3baa298789ef9b4e7839f8
-
SHA256
1eb709b43467a4cb033356b372887832e4abe2501f158aaaa3dac565a677781d
-
SHA512
e97fe8c25f07042e70ed2c4c1800e150bd789ce61e0705ae705781b66ba7c650cc194840417a7e8f945ce7a51fe8e0e81b6b7636251642901b346c54279004b9
-
SSDEEP
12288:gj8fuxR21t5i8fcZKWzVhlFw8wbVKeacsLJ0SoYNZ:gj8fuK1GYDWHfw8kVK3XN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1924 B02D.tmp 2012 B201.tmp 2040 B2DB.tmp 2324 B57A.tmp 2236 B75D.tmp 1284 B857.tmp 2756 BF97.tmp 2948 C284.tmp 2592 C38D.tmp 2700 C439.tmp 2636 C504.tmp 2936 C5BF.tmp 2612 C8DB.tmp 2156 C9F3.tmp 2436 CC73.tmp 2564 CEB4.tmp 2852 D098.tmp 2420 D172.tmp 1656 D25C.tmp 1964 D3A4.tmp 2120 D45F.tmp 1708 D633.tmp 924 D77B.tmp 1648 D8A3.tmp 1804 DB71.tmp 1528 E225.tmp 1260 E292.tmp 2344 E428.tmp 2084 E495.tmp 1700 E502.tmp 324 E57F.tmp 624 E5FC.tmp 1548 E6D6.tmp 1088 E734.tmp 2272 E782.tmp 1576 EC33.tmp 1556 ECA0.tmp 1360 EED2.tmp 1048 EF2F.tmp 372 F0F4.tmp 1028 F151.tmp 836 F1AF.tmp 816 F5A5.tmp 1288 F6DD.tmp 3040 F7B7.tmp 2960 F815.tmp 2940 F8B1.tmp 2956 F92E.tmp 872 F98B.tmp 2276 F9E9.tmp 1608 FA66.tmp 1936 FAD3.tmp 2244 FBCC.tmp 2072 FC2A.tmp 1400 FC78.tmp 1276 FCD6.tmp 1684 FD62.tmp 1988 FDEE.tmp 1908 FE7B.tmp 1940 FED8.tmp 1704 FF26.tmp 648 FF94.tmp 2332 139.tmp 2208 2DE.tmp -
Loads dropped DLL 64 IoCs
pid Process 1732 2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe 1924 B02D.tmp 2012 B201.tmp 2040 B2DB.tmp 2324 B57A.tmp 2236 B75D.tmp 1284 B857.tmp 2756 BF97.tmp 2948 C284.tmp 2592 C38D.tmp 2700 C439.tmp 2636 C504.tmp 2936 C5BF.tmp 2612 C8DB.tmp 2156 C9F3.tmp 2436 CC73.tmp 2564 CEB4.tmp 2852 D098.tmp 2420 D172.tmp 1656 D25C.tmp 1964 D3A4.tmp 2120 D45F.tmp 1708 D633.tmp 924 D77B.tmp 1648 D8A3.tmp 1804 DB71.tmp 1528 E225.tmp 1260 E292.tmp 2344 E428.tmp 2084 E495.tmp 1700 E502.tmp 324 E57F.tmp 624 E5FC.tmp 1548 E6D6.tmp 1088 E734.tmp 2272 E782.tmp 1576 EC33.tmp 1556 ECA0.tmp 1360 EED2.tmp 1048 EF2F.tmp 372 F0F4.tmp 1028 F151.tmp 836 F1AF.tmp 816 F5A5.tmp 1288 F6DD.tmp 3040 F7B7.tmp 2960 F815.tmp 2940 F8B1.tmp 2956 F92E.tmp 872 F98B.tmp 2276 F9E9.tmp 1608 FA66.tmp 1936 FAD3.tmp 2244 FBCC.tmp 2072 FC2A.tmp 1400 FC78.tmp 1276 FCD6.tmp 1684 FD62.tmp 1988 FDEE.tmp 1908 FE7B.tmp 1940 FED8.tmp 1704 FF26.tmp 648 FF94.tmp 2332 139.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1924 1732 2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe 28 PID 1732 wrote to memory of 1924 1732 2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe 28 PID 1732 wrote to memory of 1924 1732 2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe 28 PID 1732 wrote to memory of 1924 1732 2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe 28 PID 1924 wrote to memory of 2012 1924 B02D.tmp 29 PID 1924 wrote to memory of 2012 1924 B02D.tmp 29 PID 1924 wrote to memory of 2012 1924 B02D.tmp 29 PID 1924 wrote to memory of 2012 1924 B02D.tmp 29 PID 2012 wrote to memory of 2040 2012 B201.tmp 30 PID 2012 wrote to memory of 2040 2012 B201.tmp 30 PID 2012 wrote to memory of 2040 2012 B201.tmp 30 PID 2012 wrote to memory of 2040 2012 B201.tmp 30 PID 2040 wrote to memory of 2324 2040 B2DB.tmp 31 PID 2040 wrote to memory of 2324 2040 B2DB.tmp 31 PID 2040 wrote to memory of 2324 2040 B2DB.tmp 31 PID 2040 wrote to memory of 2324 2040 B2DB.tmp 31 PID 2324 wrote to memory of 2236 2324 B57A.tmp 32 PID 2324 wrote to memory of 2236 2324 B57A.tmp 32 PID 2324 wrote to memory of 2236 2324 B57A.tmp 32 PID 2324 wrote to memory of 2236 2324 B57A.tmp 32 PID 2236 wrote to memory of 1284 2236 B75D.tmp 33 PID 2236 wrote to memory of 1284 2236 B75D.tmp 33 PID 2236 wrote to memory of 1284 2236 B75D.tmp 33 PID 2236 wrote to memory of 1284 2236 B75D.tmp 33 PID 1284 wrote to memory of 2756 1284 B857.tmp 34 PID 1284 wrote to memory of 2756 1284 B857.tmp 34 PID 1284 wrote to memory of 2756 1284 B857.tmp 34 PID 1284 wrote to memory of 2756 1284 B857.tmp 34 PID 2756 wrote to memory of 2948 2756 BF97.tmp 35 PID 2756 wrote to memory of 2948 2756 BF97.tmp 35 PID 2756 wrote to memory of 2948 2756 BF97.tmp 35 PID 2756 wrote to memory of 2948 2756 BF97.tmp 35 PID 2948 wrote to memory of 2592 2948 C284.tmp 36 PID 2948 wrote to memory of 2592 2948 C284.tmp 36 PID 2948 wrote to memory of 2592 2948 C284.tmp 36 PID 2948 wrote to memory of 2592 2948 C284.tmp 36 PID 2592 wrote to memory of 2700 2592 C38D.tmp 37 PID 2592 wrote to memory of 2700 2592 C38D.tmp 37 PID 2592 wrote to memory of 2700 2592 C38D.tmp 37 PID 2592 wrote to memory of 2700 2592 C38D.tmp 37 PID 2700 wrote to memory of 2636 2700 C439.tmp 38 PID 2700 wrote to memory of 2636 2700 C439.tmp 38 PID 2700 wrote to memory of 2636 2700 C439.tmp 38 PID 2700 wrote to memory of 2636 2700 C439.tmp 38 PID 2636 wrote to memory of 2936 2636 C504.tmp 39 PID 2636 wrote to memory of 2936 2636 C504.tmp 39 PID 2636 wrote to memory of 2936 2636 C504.tmp 39 PID 2636 wrote to memory of 2936 2636 C504.tmp 39 PID 2936 wrote to memory of 2612 2936 C5BF.tmp 40 PID 2936 wrote to memory of 2612 2936 C5BF.tmp 40 PID 2936 wrote to memory of 2612 2936 C5BF.tmp 40 PID 2936 wrote to memory of 2612 2936 C5BF.tmp 40 PID 2612 wrote to memory of 2156 2612 C8DB.tmp 41 PID 2612 wrote to memory of 2156 2612 C8DB.tmp 41 PID 2612 wrote to memory of 2156 2612 C8DB.tmp 41 PID 2612 wrote to memory of 2156 2612 C8DB.tmp 41 PID 2156 wrote to memory of 2436 2156 C9F3.tmp 42 PID 2156 wrote to memory of 2436 2156 C9F3.tmp 42 PID 2156 wrote to memory of 2436 2156 C9F3.tmp 42 PID 2156 wrote to memory of 2436 2156 C9F3.tmp 42 PID 2436 wrote to memory of 2564 2436 CC73.tmp 43 PID 2436 wrote to memory of 2564 2436 CC73.tmp 43 PID 2436 wrote to memory of 2564 2436 CC73.tmp 43 PID 2436 wrote to memory of 2564 2436 CC73.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_53c55f2a4e4a1ac05e518cf4f9be0df7_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\D098.tmp"C:\Users\Admin\AppData\Local\Temp\D098.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D25C.tmp"C:\Users\Admin\AppData\Local\Temp\D25C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\D633.tmp"C:\Users\Admin\AppData\Local\Temp\D633.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D77B.tmp"C:\Users\Admin\AppData\Local\Temp\D77B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E495.tmp"C:\Users\Admin\AppData\Local\Temp\E495.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\E782.tmp"C:\Users\Admin\AppData\Local\Temp\E782.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\EC33.tmp"C:\Users\Admin\AppData\Local\Temp\EC33.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372 -
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"C:\Users\Admin\AppData\Local\Temp\F1AF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\F815.tmp"C:\Users\Admin\AppData\Local\Temp\F815.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"C:\Users\Admin\AppData\Local\Temp\F8B1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\FA66.tmp"C:\Users\Admin\AppData\Local\Temp\FA66.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:648 -
C:\Users\Admin\AppData\Local\Temp\139.tmp"C:\Users\Admin\AppData\Local\Temp\139.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"65⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\3F7.tmp"C:\Users\Admin\AppData\Local\Temp\3F7.tmp"66⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\4F0.tmp"C:\Users\Admin\AppData\Local\Temp\4F0.tmp"67⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\5AC.tmp"C:\Users\Admin\AppData\Local\Temp\5AC.tmp"68⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"69⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"70⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"71⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\7ED.tmp"C:\Users\Admin\AppData\Local\Temp\7ED.tmp"72⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"73⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"74⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"75⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"76⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"77⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"78⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"79⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"80⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\1101.tmp"C:\Users\Admin\AppData\Local\Temp\1101.tmp"81⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"82⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"83⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"84⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\12C6.tmp"C:\Users\Admin\AppData\Local\Temp\12C6.tmp"85⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"86⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\13A0.tmp"C:\Users\Admin\AppData\Local\Temp\13A0.tmp"87⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\140D.tmp"C:\Users\Admin\AppData\Local\Temp\140D.tmp"88⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp"89⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"90⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"91⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\15F1.tmp"C:\Users\Admin\AppData\Local\Temp\15F1.tmp"92⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"93⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"94⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\1842.tmp"C:\Users\Admin\AppData\Local\Temp\1842.tmp"95⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\19B8.tmp"C:\Users\Admin\AppData\Local\Temp\19B8.tmp"96⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"97⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"98⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"99⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"100⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"101⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"102⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"C:\Users\Admin\AppData\Local\Temp\1E0C.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"104⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"105⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"106⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"107⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"108⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\205C.tmp"C:\Users\Admin\AppData\Local\Temp\205C.tmp"109⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"110⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"111⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"112⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"113⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\22FB.tmp"C:\Users\Admin\AppData\Local\Temp\22FB.tmp"114⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"115⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"116⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"117⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"118⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"119⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\25B9.tmp"C:\Users\Admin\AppData\Local\Temp\25B9.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"121⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-