Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
17/08/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe
-
Size
486KB
-
MD5
14fe438d45d25dd468c82fc67d6be740
-
SHA1
8fc35a1467a8a2ed390aa481a6bb5f052a3bd893
-
SHA256
5c9c2b4c7ac864b2caebd30b8b37ba937497d9ee090ea5971635a10159bebc9c
-
SHA512
f4ac7b0b0f091f7e047e94cc0d4a891e94f05888e618e97f30f93552bf1bb01520853b3961d49fe3cd7b64a0eec0c50510c183ba196afe1d81e3259fa99b40cc
-
SSDEEP
12288:/U5rCOTeiDuTgwtPGTiD7sewjeZVVLaNZ:/UQOJD8guuGD0e/LaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2524 7169.tmp 3068 7233.tmp 2812 732D.tmp 2860 73AA.tmp 3052 74A3.tmp 2824 758D.tmp 2724 7677.tmp 2752 7781.tmp 1360 786B.tmp 2720 7945.tmp 2796 7A10.tmp 892 7AFA.tmp 576 7BE4.tmp 1188 7CCE.tmp 1420 7D79.tmp 1660 7E63.tmp 560 7F5D.tmp 1784 8076.tmp 2272 816F.tmp 2964 8259.tmp 3064 8363.tmp 1848 841E.tmp 1424 84F8.tmp 2808 8594.tmp 1964 8601.tmp 2124 867E.tmp 1956 86DC.tmp 2592 8749.tmp 1856 87B6.tmp 1044 8833.tmp 2644 88A0.tmp 108 890D.tmp 2320 898A.tmp 2168 89F7.tmp 1240 8A65.tmp 2112 8AD2.tmp 2684 8B3F.tmp 1200 8BBC.tmp 1832 8C29.tmp 980 8C96.tmp 1644 8CF4.tmp 1392 8D71.tmp 1772 8DED.tmp 2416 8E7A.tmp 1004 8EE7.tmp 1652 8F64.tmp 2128 8FD1.tmp 1136 904E.tmp 2080 90AB.tmp 596 9128.tmp 344 9195.tmp 2192 9212.tmp 876 9270.tmp 1376 92FC.tmp 1600 9369.tmp 1632 93D7.tmp 1716 9444.tmp 2516 94B1.tmp 1680 950F.tmp 2504 957C.tmp 2812 95D9.tmp 2960 9637.tmp 2860 96A4.tmp 2996 9702.tmp -
Loads dropped DLL 64 IoCs
pid Process 2388 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 2524 7169.tmp 3068 7233.tmp 2812 732D.tmp 2860 73AA.tmp 3052 74A3.tmp 2824 758D.tmp 2724 7677.tmp 2752 7781.tmp 1360 786B.tmp 2720 7945.tmp 2796 7A10.tmp 892 7AFA.tmp 576 7BE4.tmp 1188 7CCE.tmp 1420 7D79.tmp 1660 7E63.tmp 560 7F5D.tmp 1784 8076.tmp 2272 816F.tmp 2964 8259.tmp 3064 8363.tmp 1848 841E.tmp 1424 84F8.tmp 2808 8594.tmp 1964 8601.tmp 2124 867E.tmp 1956 86DC.tmp 2592 8749.tmp 1856 87B6.tmp 1044 8833.tmp 2644 88A0.tmp 108 890D.tmp 2320 898A.tmp 2168 89F7.tmp 1240 8A65.tmp 2112 8AD2.tmp 2684 8B3F.tmp 1200 8BBC.tmp 1832 8C29.tmp 980 8C96.tmp 1644 8CF4.tmp 1392 8D71.tmp 1772 8DED.tmp 2416 8E7A.tmp 1004 8EE7.tmp 1652 8F64.tmp 2128 8FD1.tmp 1136 904E.tmp 2080 90AB.tmp 596 9128.tmp 344 9195.tmp 2192 9212.tmp 876 9270.tmp 1376 92FC.tmp 1600 9369.tmp 1632 93D7.tmp 1716 9444.tmp 2516 94B1.tmp 1680 950F.tmp 2504 957C.tmp 2812 95D9.tmp 2960 9637.tmp 2860 96A4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2524 2388 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 28 PID 2388 wrote to memory of 2524 2388 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 28 PID 2388 wrote to memory of 2524 2388 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 28 PID 2388 wrote to memory of 2524 2388 14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe 28 PID 2524 wrote to memory of 3068 2524 7169.tmp 29 PID 2524 wrote to memory of 3068 2524 7169.tmp 29 PID 2524 wrote to memory of 3068 2524 7169.tmp 29 PID 2524 wrote to memory of 3068 2524 7169.tmp 29 PID 3068 wrote to memory of 2812 3068 7233.tmp 30 PID 3068 wrote to memory of 2812 3068 7233.tmp 30 PID 3068 wrote to memory of 2812 3068 7233.tmp 30 PID 3068 wrote to memory of 2812 3068 7233.tmp 30 PID 2812 wrote to memory of 2860 2812 732D.tmp 31 PID 2812 wrote to memory of 2860 2812 732D.tmp 31 PID 2812 wrote to memory of 2860 2812 732D.tmp 31 PID 2812 wrote to memory of 2860 2812 732D.tmp 31 PID 2860 wrote to memory of 3052 2860 73AA.tmp 32 PID 2860 wrote to memory of 3052 2860 73AA.tmp 32 PID 2860 wrote to memory of 3052 2860 73AA.tmp 32 PID 2860 wrote to memory of 3052 2860 73AA.tmp 32 PID 3052 wrote to memory of 2824 3052 74A3.tmp 33 PID 3052 wrote to memory of 2824 3052 74A3.tmp 33 PID 3052 wrote to memory of 2824 3052 74A3.tmp 33 PID 3052 wrote to memory of 2824 3052 74A3.tmp 33 PID 2824 wrote to memory of 2724 2824 758D.tmp 34 PID 2824 wrote to memory of 2724 2824 758D.tmp 34 PID 2824 wrote to memory of 2724 2824 758D.tmp 34 PID 2824 wrote to memory of 2724 2824 758D.tmp 34 PID 2724 wrote to memory of 2752 2724 7677.tmp 35 PID 2724 wrote to memory of 2752 2724 7677.tmp 35 PID 2724 wrote to memory of 2752 2724 7677.tmp 35 PID 2724 wrote to memory of 2752 2724 7677.tmp 35 PID 2752 wrote to memory of 1360 2752 7781.tmp 36 PID 2752 wrote to memory of 1360 2752 7781.tmp 36 PID 2752 wrote to memory of 1360 2752 7781.tmp 36 PID 2752 wrote to memory of 1360 2752 7781.tmp 36 PID 1360 wrote to memory of 2720 1360 786B.tmp 37 PID 1360 wrote to memory of 2720 1360 786B.tmp 37 PID 1360 wrote to memory of 2720 1360 786B.tmp 37 PID 1360 wrote to memory of 2720 1360 786B.tmp 37 PID 2720 wrote to memory of 2796 2720 7945.tmp 38 PID 2720 wrote to memory of 2796 2720 7945.tmp 38 PID 2720 wrote to memory of 2796 2720 7945.tmp 38 PID 2720 wrote to memory of 2796 2720 7945.tmp 38 PID 2796 wrote to memory of 892 2796 7A10.tmp 39 PID 2796 wrote to memory of 892 2796 7A10.tmp 39 PID 2796 wrote to memory of 892 2796 7A10.tmp 39 PID 2796 wrote to memory of 892 2796 7A10.tmp 39 PID 892 wrote to memory of 576 892 7AFA.tmp 40 PID 892 wrote to memory of 576 892 7AFA.tmp 40 PID 892 wrote to memory of 576 892 7AFA.tmp 40 PID 892 wrote to memory of 576 892 7AFA.tmp 40 PID 576 wrote to memory of 1188 576 7BE4.tmp 41 PID 576 wrote to memory of 1188 576 7BE4.tmp 41 PID 576 wrote to memory of 1188 576 7BE4.tmp 41 PID 576 wrote to memory of 1188 576 7BE4.tmp 41 PID 1188 wrote to memory of 1420 1188 7CCE.tmp 42 PID 1188 wrote to memory of 1420 1188 7CCE.tmp 42 PID 1188 wrote to memory of 1420 1188 7CCE.tmp 42 PID 1188 wrote to memory of 1420 1188 7CCE.tmp 42 PID 1420 wrote to memory of 1660 1420 7D79.tmp 43 PID 1420 wrote to memory of 1660 1420 7D79.tmp 43 PID 1420 wrote to memory of 1660 1420 7D79.tmp 43 PID 1420 wrote to memory of 1660 1420 7D79.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\14fe438d45d25dd468c82fc67d6be740_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\73AA.tmp"C:\Users\Admin\AppData\Local\Temp\73AA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\786B.tmp"C:\Users\Admin\AppData\Local\Temp\786B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\7945.tmp"C:\Users\Admin\AppData\Local\Temp\7945.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7D79.tmp"C:\Users\Admin\AppData\Local\Temp\7D79.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8601.tmp"C:\Users\Admin\AppData\Local\Temp\8601.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\88A0.tmp"C:\Users\Admin\AppData\Local\Temp\88A0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:108 -
C:\Users\Admin\AppData\Local\Temp\898A.tmp"C:\Users\Admin\AppData\Local\Temp\898A.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"C:\Users\Admin\AppData\Local\Temp\8AD2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8F64.tmp"C:\Users\Admin\AppData\Local\Temp\8F64.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\90AB.tmp"C:\Users\Admin\AppData\Local\Temp\90AB.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\9128.tmp"C:\Users\Admin\AppData\Local\Temp\9128.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\9212.tmp"C:\Users\Admin\AppData\Local\Temp\9212.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\9270.tmp"C:\Users\Admin\AppData\Local\Temp\9270.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\93D7.tmp"C:\Users\Admin\AppData\Local\Temp\93D7.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\9444.tmp"C:\Users\Admin\AppData\Local\Temp\9444.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\950F.tmp"C:\Users\Admin\AppData\Local\Temp\950F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"65⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"66⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"67⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"68⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"69⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"70⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"71⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"73⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"74⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"76⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"77⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"78⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"79⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"80⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"81⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"C:\Users\Admin\AppData\Local\Temp\9FA9.tmp"82⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"83⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"84⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"C:\Users\Admin\AppData\Local\Temp\A0D1.tmp"85⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"86⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"87⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\A219.tmp"C:\Users\Admin\AppData\Local\Temp\A219.tmp"88⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"89⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"90⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"91⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"92⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\A40C.tmp"C:\Users\Admin\AppData\Local\Temp\A40C.tmp"93⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"94⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"95⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"96⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"97⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"98⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"99⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"100⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"101⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"102⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"103⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"104⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"105⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"106⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"107⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"108⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"109⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"110⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"111⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"112⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"113⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"114⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"115⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"116⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"117⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"118⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"119⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"120⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"121⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-