Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/10/2023, 08:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe
-
Size
486KB
-
MD5
e1b6f2abf0ffa379d9d1051937547141
-
SHA1
47320b038111e9a8742234a75ab79b555d9c3572
-
SHA256
1daa868a473a5dcab5f725a54f29c177640ac002e505dbfeba6b0eaef8305801
-
SHA512
5efcfe5deafb40f7a3ef2b3bf43d58380f0bd1a4bb82c7675ada0ff7b95091d80e6d7dcbb075582edd3bbaaa423f7f80460b6dc15a2e33bfca04056663242041
-
SSDEEP
12288:UU5rCOTeiDEs2tMFOFR5rc1f2I5dKVTNNZ:UUQOJDEs9s3c195wNN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2900 4D94.tmp 2356 4DF1.tmp 2696 4EDB.tmp 2828 4FF4.tmp 2680 5080.tmp 2560 517A.tmp 2588 5274.tmp 2720 53CB.tmp 2552 54D4.tmp 2620 55BE.tmp 2616 565A.tmp 332 5773.tmp 268 583E.tmp 2624 5928.tmp 2836 5A12.tmp 1372 5ABD.tmp 1620 5BC6.tmp 2496 5CA1.tmp 1892 5D7B.tmp 1944 5E65.tmp 2012 60A6.tmp 2148 61CF.tmp 604 629A.tmp 1540 6316.tmp 1512 6384.tmp 1476 63F1.tmp 2032 644F.tmp 1704 64BC.tmp 2328 6539.tmp 2424 65B5.tmp 2064 6613.tmp 2652 6680.tmp 1072 66DE.tmp 2368 692F.tmp 1736 69AB.tmp 2420 6A19.tmp 2380 6A86.tmp 1160 6B03.tmp 972 6B7F.tmp 1520 6F08.tmp 1588 6F75.tmp 936 6FF2.tmp 2736 706F.tmp 1060 70EC.tmp 1076 713A.tmp 2412 71A7.tmp 1108 7214.tmp 1732 7291.tmp 1924 731D.tmp 556 738B.tmp 288 73E8.tmp 2152 7455.tmp 2124 7629.tmp 2204 7C61.tmp 2140 7CFD.tmp 1552 7DA8.tmp 3036 7DF6.tmp 2980 7E44.tmp 2088 7E92.tmp 2796 7F0F.tmp 2800 7F7C.tmp 2848 7FF9.tmp 2792 8076.tmp 2664 8112.tmp -
Loads dropped DLL 64 IoCs
pid Process 2016 NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe 2900 4D94.tmp 2356 4DF1.tmp 2696 4EDB.tmp 2828 4FF4.tmp 2680 5080.tmp 2560 517A.tmp 2588 5274.tmp 2720 53CB.tmp 2552 54D4.tmp 2620 55BE.tmp 2616 565A.tmp 332 5773.tmp 268 583E.tmp 2624 5928.tmp 2836 5A12.tmp 1372 5ABD.tmp 1620 5BC6.tmp 2496 5CA1.tmp 1892 5D7B.tmp 1944 5E65.tmp 2012 60A6.tmp 2148 61CF.tmp 604 629A.tmp 1540 6316.tmp 1512 6384.tmp 1476 63F1.tmp 2032 644F.tmp 1704 64BC.tmp 2328 6539.tmp 2424 65B5.tmp 2064 6613.tmp 2652 6680.tmp 1072 66DE.tmp 2368 692F.tmp 1736 69AB.tmp 2420 6A19.tmp 2380 6A86.tmp 1160 6B03.tmp 972 6B7F.tmp 1520 6F08.tmp 1588 6F75.tmp 936 6FF2.tmp 2736 706F.tmp 1060 70EC.tmp 1076 713A.tmp 2412 71A7.tmp 1108 7214.tmp 1732 7291.tmp 1924 731D.tmp 556 738B.tmp 288 73E8.tmp 2152 7455.tmp 2124 7629.tmp 2204 7C61.tmp 2140 7CFD.tmp 1552 7DA8.tmp 3036 7DF6.tmp 2980 7E44.tmp 2088 7E92.tmp 2796 7F0F.tmp 2800 7F7C.tmp 2848 7FF9.tmp 2792 8076.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2900 2016 NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe 28 PID 2016 wrote to memory of 2900 2016 NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe 28 PID 2016 wrote to memory of 2900 2016 NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe 28 PID 2016 wrote to memory of 2900 2016 NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe 28 PID 2900 wrote to memory of 2356 2900 4D94.tmp 29 PID 2900 wrote to memory of 2356 2900 4D94.tmp 29 PID 2900 wrote to memory of 2356 2900 4D94.tmp 29 PID 2900 wrote to memory of 2356 2900 4D94.tmp 29 PID 2356 wrote to memory of 2696 2356 4DF1.tmp 30 PID 2356 wrote to memory of 2696 2356 4DF1.tmp 30 PID 2356 wrote to memory of 2696 2356 4DF1.tmp 30 PID 2356 wrote to memory of 2696 2356 4DF1.tmp 30 PID 2696 wrote to memory of 2828 2696 4EDB.tmp 31 PID 2696 wrote to memory of 2828 2696 4EDB.tmp 31 PID 2696 wrote to memory of 2828 2696 4EDB.tmp 31 PID 2696 wrote to memory of 2828 2696 4EDB.tmp 31 PID 2828 wrote to memory of 2680 2828 4FF4.tmp 32 PID 2828 wrote to memory of 2680 2828 4FF4.tmp 32 PID 2828 wrote to memory of 2680 2828 4FF4.tmp 32 PID 2828 wrote to memory of 2680 2828 4FF4.tmp 32 PID 2680 wrote to memory of 2560 2680 5080.tmp 33 PID 2680 wrote to memory of 2560 2680 5080.tmp 33 PID 2680 wrote to memory of 2560 2680 5080.tmp 33 PID 2680 wrote to memory of 2560 2680 5080.tmp 33 PID 2560 wrote to memory of 2588 2560 517A.tmp 34 PID 2560 wrote to memory of 2588 2560 517A.tmp 34 PID 2560 wrote to memory of 2588 2560 517A.tmp 34 PID 2560 wrote to memory of 2588 2560 517A.tmp 34 PID 2588 wrote to memory of 2720 2588 5274.tmp 35 PID 2588 wrote to memory of 2720 2588 5274.tmp 35 PID 2588 wrote to memory of 2720 2588 5274.tmp 35 PID 2588 wrote to memory of 2720 2588 5274.tmp 35 PID 2720 wrote to memory of 2552 2720 53CB.tmp 36 PID 2720 wrote to memory of 2552 2720 53CB.tmp 36 PID 2720 wrote to memory of 2552 2720 53CB.tmp 36 PID 2720 wrote to memory of 2552 2720 53CB.tmp 36 PID 2552 wrote to memory of 2620 2552 54D4.tmp 37 PID 2552 wrote to memory of 2620 2552 54D4.tmp 37 PID 2552 wrote to memory of 2620 2552 54D4.tmp 37 PID 2552 wrote to memory of 2620 2552 54D4.tmp 37 PID 2620 wrote to memory of 2616 2620 55BE.tmp 38 PID 2620 wrote to memory of 2616 2620 55BE.tmp 38 PID 2620 wrote to memory of 2616 2620 55BE.tmp 38 PID 2620 wrote to memory of 2616 2620 55BE.tmp 38 PID 2616 wrote to memory of 332 2616 565A.tmp 39 PID 2616 wrote to memory of 332 2616 565A.tmp 39 PID 2616 wrote to memory of 332 2616 565A.tmp 39 PID 2616 wrote to memory of 332 2616 565A.tmp 39 PID 332 wrote to memory of 268 332 5773.tmp 40 PID 332 wrote to memory of 268 332 5773.tmp 40 PID 332 wrote to memory of 268 332 5773.tmp 40 PID 332 wrote to memory of 268 332 5773.tmp 40 PID 268 wrote to memory of 2624 268 583E.tmp 41 PID 268 wrote to memory of 2624 268 583E.tmp 41 PID 268 wrote to memory of 2624 268 583E.tmp 41 PID 268 wrote to memory of 2624 268 583E.tmp 41 PID 2624 wrote to memory of 2836 2624 5928.tmp 42 PID 2624 wrote to memory of 2836 2624 5928.tmp 42 PID 2624 wrote to memory of 2836 2624 5928.tmp 42 PID 2624 wrote to memory of 2836 2624 5928.tmp 42 PID 2836 wrote to memory of 1372 2836 5A12.tmp 43 PID 2836 wrote to memory of 1372 2836 5A12.tmp 43 PID 2836 wrote to memory of 1372 2836 5A12.tmp 43 PID 2836 wrote to memory of 1372 2836 5A12.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_e1b6f2abf0ffa379d9d1051937547141_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4D94.tmp"C:\Users\Admin\AppData\Local\Temp\4D94.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5080.tmp"C:\Users\Admin\AppData\Local\Temp\5080.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\517A.tmp"C:\Users\Admin\AppData\Local\Temp\517A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\53CB.tmp"C:\Users\Admin\AppData\Local\Temp\53CB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\55BE.tmp"C:\Users\Admin\AppData\Local\Temp\55BE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\583E.tmp"C:\Users\Admin\AppData\Local\Temp\583E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"C:\Users\Admin\AppData\Local\Temp\5BC6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"C:\Users\Admin\AppData\Local\Temp\5CA1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"C:\Users\Admin\AppData\Local\Temp\5D7B.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\60A6.tmp"C:\Users\Admin\AppData\Local\Temp\60A6.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\6316.tmp"C:\Users\Admin\AppData\Local\Temp\6316.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\63F1.tmp"C:\Users\Admin\AppData\Local\Temp\63F1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\692F.tmp"C:\Users\Admin\AppData\Local\Temp\692F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\69AB.tmp"C:\Users\Admin\AppData\Local\Temp\69AB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\6A86.tmp"C:\Users\Admin\AppData\Local\Temp\6A86.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"C:\Users\Admin\AppData\Local\Temp\7CFD.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"65⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"66⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"67⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"70⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"71⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"72⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"73⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"74⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\8585.tmp"C:\Users\Admin\AppData\Local\Temp\8585.tmp"75⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"76⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"77⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\86CC.tmp"C:\Users\Admin\AppData\Local\Temp\86CC.tmp"78⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"79⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"80⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\8814.tmp"C:\Users\Admin\AppData\Local\Temp\8814.tmp"81⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"82⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"83⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"84⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\89C9.tmp"C:\Users\Admin\AppData\Local\Temp\89C9.tmp"85⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"86⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"87⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"88⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"C:\Users\Admin\AppData\Local\Temp\8B4F.tmp"89⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"90⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"91⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"92⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"93⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"94⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"95⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"96⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"97⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"98⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"99⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"C:\Users\Admin\AppData\Local\Temp\8FA2.tmp"100⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"101⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"102⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\90F9.tmp"C:\Users\Admin\AppData\Local\Temp\90F9.tmp"103⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"104⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"105⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\934A.tmp"C:\Users\Admin\AppData\Local\Temp\934A.tmp"106⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\93C7.tmp"C:\Users\Admin\AppData\Local\Temp\93C7.tmp"107⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"108⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"109⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"110⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"111⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"112⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"113⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"114⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"115⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"116⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\97CD.tmp"C:\Users\Admin\AppData\Local\Temp\97CD.tmp"117⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"118⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"119⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"120⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"121⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"122⤵PID:864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-