Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 17:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe
-
Size
486KB
-
MD5
63c911a4e11c856794c0d68d1433cf54
-
SHA1
8d5c9e7a7a646a78473037cba909c88d8485e313
-
SHA256
9ec65efee3c707c58c30a7c413ee114af832baf4191fc580904b6270bc0cc52a
-
SHA512
f67a1e11033eb1ebb31e2e96b9dedc99ac3fe731c4e0022b6e92a4a0b86791738ba3b5bfe147add39578f88f6dcaf9ce467677d46ef87cca81ccdeefb0087262
-
SSDEEP
12288:oU5rCOTeiDFr2bF/6JMr6ztAxflgQg/zNZ:oUQOJDR2x/6JMre6lgnzN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2080 AAE6.tmp 860 AC2E.tmp 4108 ACE9.tmp 408 B65F.tmp 2004 B6FC.tmp 2016 B788.tmp 3764 B863.tmp 4484 B92E.tmp 3468 B9CA.tmp 4672 BA67.tmp 2888 BAF3.tmp 220 BBAF.tmp 1764 BC3B.tmp 4632 BCE7.tmp 4488 BD83.tmp 3860 BE2F.tmp 4944 BEDB.tmp 2060 BF87.tmp 1424 C062.tmp 2724 C227.tmp 2528 C2C3.tmp 2760 C36F.tmp 1448 C42B.tmp 4116 C4F6.tmp 3572 C5A2.tmp 2768 C67C.tmp 4720 C709.tmp 1700 C7D4.tmp 1344 C8AF.tmp 5048 C98A.tmp 4964 CA84.tmp 3832 CB3F.tmp 2884 CBCC.tmp 2992 CC68.tmp 412 CD04.tmp 4884 CDA0.tmp 2852 CE2D.tmp 1896 CEAA.tmp 3876 CF46.tmp 264 CFC3.tmp 4136 D060.tmp 2080 D0EC.tmp 3216 D169.tmp 4708 D1E6.tmp 4696 D263.tmp 4456 D2F0.tmp 408 D35D.tmp 4492 D419.tmp 4304 D4A5.tmp 1552 D522.tmp 2428 D5AF.tmp 1708 D62C.tmp 2820 D6B9.tmp 4956 D745.tmp 4672 D7D2.tmp 4588 D85E.tmp 2940 D8EB.tmp 4948 D978.tmp 4156 DA04.tmp 1940 DA72.tmp 756 DAEF.tmp 3096 DB8B.tmp 4728 DBF8.tmp 888 DC66.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2080 2920 63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe 85 PID 2920 wrote to memory of 2080 2920 63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe 85 PID 2920 wrote to memory of 2080 2920 63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe 85 PID 2080 wrote to memory of 860 2080 AAE6.tmp 86 PID 2080 wrote to memory of 860 2080 AAE6.tmp 86 PID 2080 wrote to memory of 860 2080 AAE6.tmp 86 PID 860 wrote to memory of 4108 860 AC2E.tmp 87 PID 860 wrote to memory of 4108 860 AC2E.tmp 87 PID 860 wrote to memory of 4108 860 AC2E.tmp 87 PID 4108 wrote to memory of 408 4108 ACE9.tmp 88 PID 4108 wrote to memory of 408 4108 ACE9.tmp 88 PID 4108 wrote to memory of 408 4108 ACE9.tmp 88 PID 408 wrote to memory of 2004 408 B65F.tmp 89 PID 408 wrote to memory of 2004 408 B65F.tmp 89 PID 408 wrote to memory of 2004 408 B65F.tmp 89 PID 2004 wrote to memory of 2016 2004 B6FC.tmp 90 PID 2004 wrote to memory of 2016 2004 B6FC.tmp 90 PID 2004 wrote to memory of 2016 2004 B6FC.tmp 90 PID 2016 wrote to memory of 3764 2016 B788.tmp 91 PID 2016 wrote to memory of 3764 2016 B788.tmp 91 PID 2016 wrote to memory of 3764 2016 B788.tmp 91 PID 3764 wrote to memory of 4484 3764 B863.tmp 92 PID 3764 wrote to memory of 4484 3764 B863.tmp 92 PID 3764 wrote to memory of 4484 3764 B863.tmp 92 PID 4484 wrote to memory of 3468 4484 B92E.tmp 93 PID 4484 wrote to memory of 3468 4484 B92E.tmp 93 PID 4484 wrote to memory of 3468 4484 B92E.tmp 93 PID 3468 wrote to memory of 4672 3468 B9CA.tmp 94 PID 3468 wrote to memory of 4672 3468 B9CA.tmp 94 PID 3468 wrote to memory of 4672 3468 B9CA.tmp 94 PID 4672 wrote to memory of 2888 4672 BA67.tmp 95 PID 4672 wrote to memory of 2888 4672 BA67.tmp 95 PID 4672 wrote to memory of 2888 4672 BA67.tmp 95 PID 2888 wrote to memory of 220 2888 BAF3.tmp 96 PID 2888 wrote to memory of 220 2888 BAF3.tmp 96 PID 2888 wrote to memory of 220 2888 BAF3.tmp 96 PID 220 wrote to memory of 1764 220 BBAF.tmp 97 PID 220 wrote to memory of 1764 220 BBAF.tmp 97 PID 220 wrote to memory of 1764 220 BBAF.tmp 97 PID 1764 wrote to memory of 4632 1764 BC3B.tmp 98 PID 1764 wrote to memory of 4632 1764 BC3B.tmp 98 PID 1764 wrote to memory of 4632 1764 BC3B.tmp 98 PID 4632 wrote to memory of 4488 4632 BCE7.tmp 99 PID 4632 wrote to memory of 4488 4632 BCE7.tmp 99 PID 4632 wrote to memory of 4488 4632 BCE7.tmp 99 PID 4488 wrote to memory of 3860 4488 BD83.tmp 102 PID 4488 wrote to memory of 3860 4488 BD83.tmp 102 PID 4488 wrote to memory of 3860 4488 BD83.tmp 102 PID 3860 wrote to memory of 4944 3860 BE2F.tmp 103 PID 3860 wrote to memory of 4944 3860 BE2F.tmp 103 PID 3860 wrote to memory of 4944 3860 BE2F.tmp 103 PID 4944 wrote to memory of 2060 4944 BEDB.tmp 104 PID 4944 wrote to memory of 2060 4944 BEDB.tmp 104 PID 4944 wrote to memory of 2060 4944 BEDB.tmp 104 PID 2060 wrote to memory of 1424 2060 BF87.tmp 105 PID 2060 wrote to memory of 1424 2060 BF87.tmp 105 PID 2060 wrote to memory of 1424 2060 BF87.tmp 105 PID 1424 wrote to memory of 2724 1424 C062.tmp 106 PID 1424 wrote to memory of 2724 1424 C062.tmp 106 PID 1424 wrote to memory of 2724 1424 C062.tmp 106 PID 2724 wrote to memory of 2528 2724 C227.tmp 108 PID 2724 wrote to memory of 2528 2724 C227.tmp 108 PID 2724 wrote to memory of 2528 2724 C227.tmp 108 PID 2528 wrote to memory of 2760 2528 C2C3.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\63c911a4e11c856794c0d68d1433cf54_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"23⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"24⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"25⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"26⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"27⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"28⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"29⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"30⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"31⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"32⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"33⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"34⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"35⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"36⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"37⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"38⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"39⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"40⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"41⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"42⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"43⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"44⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"45⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"46⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"47⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"48⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"49⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"50⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"51⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"52⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"53⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"54⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"55⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"56⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"57⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"58⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"59⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"60⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"61⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"C:\Users\Admin\AppData\Local\Temp\DAEF.tmp"62⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"63⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"64⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"65⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"67⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"68⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"70⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"71⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\E00F.tmp"C:\Users\Admin\AppData\Local\Temp\E00F.tmp"72⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"73⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"74⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"75⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"76⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E33C.tmp"C:\Users\Admin\AppData\Local\Temp\E33C.tmp"77⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"78⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"79⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"C:\Users\Admin\AppData\Local\Temp\E4D2.tmp"80⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"81⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"C:\Users\Admin\AppData\Local\Temp\E5BC.tmp"82⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"83⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"84⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"85⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"86⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"87⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"88⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"89⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"90⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"91⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"92⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"93⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"94⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"95⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"96⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"97⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"98⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"99⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"100⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"101⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"102⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"103⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"105⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"106⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"107⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"108⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"109⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"110⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"111⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"C:\Users\Admin\AppData\Local\Temp\F5E9.tmp"112⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"113⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"114⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"115⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"116⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"117⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"118⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"119⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"120⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"121⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"122⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-