Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30/08/2023, 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe
-
Size
487KB
-
MD5
dfda212249747aa81249d5fcaf2e49c4
-
SHA1
9860581e88ab29ebbc49f07148162ec082cc4644
-
SHA256
32047fad6394afeaa4cd07bf62bcc75e7213f6d9ace65de013b218a53a2544c2
-
SHA512
4359f2754f555c20a284be5f76a0c323925b7bee33731ef3921b51ba4e710c6b530d1b4a469555563d7d0b0b540d266a6271ea3090a147b7a7971c7eaab92667
-
SSDEEP
12288:yU5rCOTeiNB89pKeWI9v3WYIAZun46bZ:yUQOJNCp40Wgyb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2056 82D6.tmp 1984 8363.tmp 2848 83EF.tmp 3020 84E9.tmp 3052 85B3.tmp 1044 86AD.tmp 3032 87B6.tmp 1956 8881.tmp 2720 893C.tmp 2784 8A17.tmp 2428 8B01.tmp 576 8BEB.tmp 1520 8CC5.tmp 1808 8D80.tmp 2464 8DFD.tmp 2760 8E4B.tmp 2188 8EE7.tmp 1912 8FF0.tmp 1756 90DA.tmp 1016 9195.tmp 2964 9251.tmp 1704 930C.tmp 2924 957C.tmp 2900 9608.tmp 2016 9675.tmp 2688 96E3.tmp 2000 9750.tmp 540 97DC.tmp 1696 9869.tmp 2904 98E5.tmp 2284 9943.tmp 2616 99B0.tmp 2608 9A1D.tmp 2604 9A8B.tmp 1656 9B17.tmp 528 9B94.tmp 440 9C11.tmp 1788 9C9D.tmp 2920 9D0A.tmp 992 9D87.tmp 2380 9E04.tmp 1560 9E81.tmp 1640 9EFD.tmp 2644 9F6B.tmp 956 9FE7.tmp 948 A055.tmp 1776 A0C2.tmp 2088 A12F.tmp 2220 A18D.tmp 1408 A209.tmp 2232 A267.tmp 888 A2D4.tmp 2268 A361.tmp 2228 A3CE.tmp 1616 A42B.tmp 2076 A4B8.tmp 2540 A525.tmp 2512 A592.tmp 2860 A61F.tmp 2996 A68C.tmp 2876 A718.tmp 2004 A7A5.tmp 2844 A821.tmp 3052 A87F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2600 dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe 2056 82D6.tmp 1984 8363.tmp 2848 83EF.tmp 3020 84E9.tmp 3052 85B3.tmp 1044 86AD.tmp 3032 87B6.tmp 1956 8881.tmp 2720 893C.tmp 2784 8A17.tmp 2428 8B01.tmp 576 8BEB.tmp 1520 8CC5.tmp 1808 8D80.tmp 2464 8DFD.tmp 2760 8E4B.tmp 2188 8EE7.tmp 1912 8FF0.tmp 1756 90DA.tmp 1016 9195.tmp 2964 9251.tmp 1704 930C.tmp 2924 957C.tmp 2900 9608.tmp 2016 9675.tmp 2688 96E3.tmp 2000 9750.tmp 540 97DC.tmp 1696 9869.tmp 2904 98E5.tmp 2284 9943.tmp 2616 99B0.tmp 2608 9A1D.tmp 2604 9A8B.tmp 1656 9B17.tmp 528 9B94.tmp 440 9C11.tmp 1788 9C9D.tmp 2920 9D0A.tmp 992 9D87.tmp 2380 9E04.tmp 1560 9E81.tmp 1640 9EFD.tmp 2644 9F6B.tmp 956 9FE7.tmp 948 A055.tmp 1776 A0C2.tmp 2088 A12F.tmp 2220 A18D.tmp 1408 A209.tmp 2232 A267.tmp 888 A2D4.tmp 2268 A361.tmp 2228 A3CE.tmp 1616 A42B.tmp 2076 A4B8.tmp 2540 A525.tmp 2512 A592.tmp 2860 A61F.tmp 2996 A68C.tmp 2876 A718.tmp 2004 A7A5.tmp 2844 A821.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 2056 2600 dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe 28 PID 2600 wrote to memory of 2056 2600 dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe 28 PID 2600 wrote to memory of 2056 2600 dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe 28 PID 2600 wrote to memory of 2056 2600 dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe 28 PID 2056 wrote to memory of 1984 2056 82D6.tmp 29 PID 2056 wrote to memory of 1984 2056 82D6.tmp 29 PID 2056 wrote to memory of 1984 2056 82D6.tmp 29 PID 2056 wrote to memory of 1984 2056 82D6.tmp 29 PID 1984 wrote to memory of 2848 1984 8363.tmp 30 PID 1984 wrote to memory of 2848 1984 8363.tmp 30 PID 1984 wrote to memory of 2848 1984 8363.tmp 30 PID 1984 wrote to memory of 2848 1984 8363.tmp 30 PID 2848 wrote to memory of 3020 2848 83EF.tmp 31 PID 2848 wrote to memory of 3020 2848 83EF.tmp 31 PID 2848 wrote to memory of 3020 2848 83EF.tmp 31 PID 2848 wrote to memory of 3020 2848 83EF.tmp 31 PID 3020 wrote to memory of 3052 3020 84E9.tmp 32 PID 3020 wrote to memory of 3052 3020 84E9.tmp 32 PID 3020 wrote to memory of 3052 3020 84E9.tmp 32 PID 3020 wrote to memory of 3052 3020 84E9.tmp 32 PID 3052 wrote to memory of 1044 3052 85B3.tmp 33 PID 3052 wrote to memory of 1044 3052 85B3.tmp 33 PID 3052 wrote to memory of 1044 3052 85B3.tmp 33 PID 3052 wrote to memory of 1044 3052 85B3.tmp 33 PID 1044 wrote to memory of 3032 1044 86AD.tmp 34 PID 1044 wrote to memory of 3032 1044 86AD.tmp 34 PID 1044 wrote to memory of 3032 1044 86AD.tmp 34 PID 1044 wrote to memory of 3032 1044 86AD.tmp 34 PID 3032 wrote to memory of 1956 3032 87B6.tmp 35 PID 3032 wrote to memory of 1956 3032 87B6.tmp 35 PID 3032 wrote to memory of 1956 3032 87B6.tmp 35 PID 3032 wrote to memory of 1956 3032 87B6.tmp 35 PID 1956 wrote to memory of 2720 1956 8881.tmp 36 PID 1956 wrote to memory of 2720 1956 8881.tmp 36 PID 1956 wrote to memory of 2720 1956 8881.tmp 36 PID 1956 wrote to memory of 2720 1956 8881.tmp 36 PID 2720 wrote to memory of 2784 2720 893C.tmp 37 PID 2720 wrote to memory of 2784 2720 893C.tmp 37 PID 2720 wrote to memory of 2784 2720 893C.tmp 37 PID 2720 wrote to memory of 2784 2720 893C.tmp 37 PID 2784 wrote to memory of 2428 2784 8A17.tmp 38 PID 2784 wrote to memory of 2428 2784 8A17.tmp 38 PID 2784 wrote to memory of 2428 2784 8A17.tmp 38 PID 2784 wrote to memory of 2428 2784 8A17.tmp 38 PID 2428 wrote to memory of 576 2428 8B01.tmp 39 PID 2428 wrote to memory of 576 2428 8B01.tmp 39 PID 2428 wrote to memory of 576 2428 8B01.tmp 39 PID 2428 wrote to memory of 576 2428 8B01.tmp 39 PID 576 wrote to memory of 1520 576 8BEB.tmp 40 PID 576 wrote to memory of 1520 576 8BEB.tmp 40 PID 576 wrote to memory of 1520 576 8BEB.tmp 40 PID 576 wrote to memory of 1520 576 8BEB.tmp 40 PID 1520 wrote to memory of 1808 1520 8CC5.tmp 41 PID 1520 wrote to memory of 1808 1520 8CC5.tmp 41 PID 1520 wrote to memory of 1808 1520 8CC5.tmp 41 PID 1520 wrote to memory of 1808 1520 8CC5.tmp 41 PID 1808 wrote to memory of 2464 1808 8D80.tmp 42 PID 1808 wrote to memory of 2464 1808 8D80.tmp 42 PID 1808 wrote to memory of 2464 1808 8D80.tmp 42 PID 1808 wrote to memory of 2464 1808 8D80.tmp 42 PID 2464 wrote to memory of 2760 2464 8DFD.tmp 43 PID 2464 wrote to memory of 2760 2464 8DFD.tmp 43 PID 2464 wrote to memory of 2760 2464 8DFD.tmp 43 PID 2464 wrote to memory of 2760 2464 8DFD.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\dfda212249747aa81249d5fcaf2e49c4_mafia_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\83EF.tmp"C:\Users\Admin\AppData\Local\Temp\83EF.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8881.tmp"C:\Users\Admin\AppData\Local\Temp\8881.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"C:\Users\Admin\AppData\Local\Temp\8EE7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\930C.tmp"C:\Users\Admin\AppData\Local\Temp\930C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\957C.tmp"C:\Users\Admin\AppData\Local\Temp\957C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\98E5.tmp"C:\Users\Admin\AppData\Local\Temp\98E5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"C:\Users\Admin\AppData\Local\Temp\9D0A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9D87.tmp"C:\Users\Admin\AppData\Local\Temp\9D87.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"C:\Users\Admin\AppData\Local\Temp\9EFD.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:948 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\A267.tmp"C:\Users\Admin\AppData\Local\Temp\A267.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\A361.tmp"C:\Users\Admin\AppData\Local\Temp\A361.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"C:\Users\Admin\AppData\Local\Temp\A3CE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\A42B.tmp"C:\Users\Admin\AppData\Local\Temp\A42B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"65⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"66⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"67⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"68⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"69⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"70⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"71⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"72⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"73⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"74⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\AED5.tmp"C:\Users\Admin\AppData\Local\Temp\AED5.tmp"75⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"76⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"77⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"78⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"79⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"80⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"81⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"82⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"83⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"84⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"85⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"86⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"87⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"89⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"90⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"91⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"92⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"94⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"95⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"96⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"97⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"98⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"99⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"100⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"101⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"102⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"103⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp"C:\Users\Admin\AppData\Local\Temp\BB63.tmp"104⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"105⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"106⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"107⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"108⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"109⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"110⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"111⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"C:\Users\Admin\AppData\Local\Temp\BEAD.tmp"112⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"113⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"114⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"115⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"116⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"117⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"118⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"119⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"120⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"121⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-