Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe
-
Size
486KB
-
MD5
330ebc5544b6cc550f54ddda412e393f
-
SHA1
6ae3acbed8272154650cad580a2af2e68d2b7744
-
SHA256
f0096c7b7f8306eeb3f18d33edb753361b2353f3d689afb930d3c9c0a7c628de
-
SHA512
11fa0365bdb8f9fe295d18fdbc66ddb582ce45728b803bb4f0e36faf677a62c6a6976baba74744cbef53fd818a84bd8827317118bd47cf3555d1c69cd7d5a9d6
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7BTFW0jynB0NMDmMQXowR4rsSYgvtuddyJVwC:/U5rCOTeiDB5W2yJz2oFtCLJN36BnNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2648 D179.tmp 4700 D254.tmp 2008 D33E.tmp 4552 D448.tmp 4632 D513.tmp 5060 D5FD.tmp 4616 D6F7.tmp 3428 D793.tmp 608 D85E.tmp 3408 D949.tmp 4188 D9E5.tmp 3976 DAC0.tmp 4388 DB7B.tmp 4156 DC46.tmp 4120 DD21.tmp 1408 DDFC.tmp 1784 DEB7.tmp 4344 DFA2.tmp 1404 E05D.tmp 1748 E0EA.tmp 1976 E1D4.tmp 2508 E2AF.tmp 4812 E35B.tmp 1760 E455.tmp 1996 E530.tmp 5028 E5CC.tmp 3860 E6B6.tmp 3960 E7A1.tmp 896 E82D.tmp 1524 E908.tmp 5076 E9D3.tmp 2260 EADD.tmp 4612 EC73.tmp 2352 ED2F.tmp 2296 EDDA.tmp 1652 EE96.tmp 1572 EF42.tmp 2844 F03C.tmp 2108 F0F7.tmp 4112 F1B3.tmp 3060 F24F.tmp 2148 F2CC.tmp 3796 F359.tmp 2908 F3B6.tmp 3320 F443.tmp 3456 F4C0.tmp 3216 F54D.tmp 4500 F5E9.tmp 1664 F676.tmp 4244 F6F3.tmp 2960 F760.tmp 2224 F7ED.tmp 3800 F86A.tmp 4256 F906.tmp 1668 F9C1.tmp 1072 FB86.tmp 1432 FC13.tmp 1028 FC90.tmp 1712 FD0D.tmp 4100 FD9A.tmp 1460 FE26.tmp 4432 FEA3.tmp 2812 FF40.tmp 2276 FFFB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3888 wrote to memory of 2648 3888 330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe 85 PID 3888 wrote to memory of 2648 3888 330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe 85 PID 3888 wrote to memory of 2648 3888 330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe 85 PID 2648 wrote to memory of 4700 2648 D179.tmp 86 PID 2648 wrote to memory of 4700 2648 D179.tmp 86 PID 2648 wrote to memory of 4700 2648 D179.tmp 86 PID 4700 wrote to memory of 2008 4700 D254.tmp 87 PID 4700 wrote to memory of 2008 4700 D254.tmp 87 PID 4700 wrote to memory of 2008 4700 D254.tmp 87 PID 2008 wrote to memory of 4552 2008 D33E.tmp 89 PID 2008 wrote to memory of 4552 2008 D33E.tmp 89 PID 2008 wrote to memory of 4552 2008 D33E.tmp 89 PID 4552 wrote to memory of 4632 4552 D448.tmp 90 PID 4552 wrote to memory of 4632 4552 D448.tmp 90 PID 4552 wrote to memory of 4632 4552 D448.tmp 90 PID 4632 wrote to memory of 5060 4632 D513.tmp 91 PID 4632 wrote to memory of 5060 4632 D513.tmp 91 PID 4632 wrote to memory of 5060 4632 D513.tmp 91 PID 5060 wrote to memory of 4616 5060 D5FD.tmp 92 PID 5060 wrote to memory of 4616 5060 D5FD.tmp 92 PID 5060 wrote to memory of 4616 5060 D5FD.tmp 92 PID 4616 wrote to memory of 3428 4616 D6F7.tmp 93 PID 4616 wrote to memory of 3428 4616 D6F7.tmp 93 PID 4616 wrote to memory of 3428 4616 D6F7.tmp 93 PID 3428 wrote to memory of 608 3428 D793.tmp 94 PID 3428 wrote to memory of 608 3428 D793.tmp 94 PID 3428 wrote to memory of 608 3428 D793.tmp 94 PID 608 wrote to memory of 3408 608 D85E.tmp 95 PID 608 wrote to memory of 3408 608 D85E.tmp 95 PID 608 wrote to memory of 3408 608 D85E.tmp 95 PID 3408 wrote to memory of 4188 3408 D949.tmp 96 PID 3408 wrote to memory of 4188 3408 D949.tmp 96 PID 3408 wrote to memory of 4188 3408 D949.tmp 96 PID 4188 wrote to memory of 3976 4188 D9E5.tmp 97 PID 4188 wrote to memory of 3976 4188 D9E5.tmp 97 PID 4188 wrote to memory of 3976 4188 D9E5.tmp 97 PID 3976 wrote to memory of 4388 3976 DAC0.tmp 98 PID 3976 wrote to memory of 4388 3976 DAC0.tmp 98 PID 3976 wrote to memory of 4388 3976 DAC0.tmp 98 PID 4388 wrote to memory of 4156 4388 DB7B.tmp 99 PID 4388 wrote to memory of 4156 4388 DB7B.tmp 99 PID 4388 wrote to memory of 4156 4388 DB7B.tmp 99 PID 4156 wrote to memory of 4120 4156 DC46.tmp 100 PID 4156 wrote to memory of 4120 4156 DC46.tmp 100 PID 4156 wrote to memory of 4120 4156 DC46.tmp 100 PID 4120 wrote to memory of 1408 4120 DD21.tmp 102 PID 4120 wrote to memory of 1408 4120 DD21.tmp 102 PID 4120 wrote to memory of 1408 4120 DD21.tmp 102 PID 1408 wrote to memory of 1784 1408 DDFC.tmp 103 PID 1408 wrote to memory of 1784 1408 DDFC.tmp 103 PID 1408 wrote to memory of 1784 1408 DDFC.tmp 103 PID 1784 wrote to memory of 4344 1784 DEB7.tmp 104 PID 1784 wrote to memory of 4344 1784 DEB7.tmp 104 PID 1784 wrote to memory of 4344 1784 DEB7.tmp 104 PID 4344 wrote to memory of 1404 4344 DFA2.tmp 105 PID 4344 wrote to memory of 1404 4344 DFA2.tmp 105 PID 4344 wrote to memory of 1404 4344 DFA2.tmp 105 PID 1404 wrote to memory of 1748 1404 E05D.tmp 106 PID 1404 wrote to memory of 1748 1404 E05D.tmp 106 PID 1404 wrote to memory of 1748 1404 E05D.tmp 106 PID 1748 wrote to memory of 1976 1748 E0EA.tmp 110 PID 1748 wrote to memory of 1976 1748 E0EA.tmp 110 PID 1748 wrote to memory of 1976 1748 E0EA.tmp 110 PID 1976 wrote to memory of 2508 1976 E1D4.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\330ebc5544b6cc550f54ddda412e393f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"C:\Users\Admin\AppData\Local\Temp\D6F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"C:\Users\Admin\AppData\Local\Temp\D9E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"C:\Users\Admin\AppData\Local\Temp\E1D4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"23⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"24⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\E455.tmp"C:\Users\Admin\AppData\Local\Temp\E455.tmp"25⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\E530.tmp"C:\Users\Admin\AppData\Local\Temp\E530.tmp"26⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"27⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"28⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"29⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"30⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"31⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"32⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"33⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"34⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\EC73.tmp"C:\Users\Admin\AppData\Local\Temp\EC73.tmp"35⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"36⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"37⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"38⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"39⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"40⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"41⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"42⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"43⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"44⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"45⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"46⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"47⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"48⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"49⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"50⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"51⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"52⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"53⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"54⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"55⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"56⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"57⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"58⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"59⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"60⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"61⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"62⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"63⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"64⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"65⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"66⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"67⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"68⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"69⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"70⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"71⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"73⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"74⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"75⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"76⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\683.tmp"C:\Users\Admin\AppData\Local\Temp\683.tmp"77⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"78⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"79⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"80⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"81⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"82⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"83⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"84⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"86⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"87⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"88⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"89⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"90⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"91⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"92⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"93⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"94⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"95⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"96⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"97⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"98⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"99⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"100⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"101⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"102⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"103⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"104⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"105⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"106⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"107⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"108⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"109⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"110⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"111⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"112⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"113⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"114⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"115⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"116⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\1B82.tmp"C:\Users\Admin\AppData\Local\Temp\1B82.tmp"117⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"119⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"120⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"121⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"122⤵PID:4256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-