Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 13:46
Static task
static1
Behavioral task
behavioral1
Sample
7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe
-
Size
520KB
-
MD5
7385d3778c85b11e8c185d624ac0d0e5
-
SHA1
9067200b6b79a6abdc7a2cb16480bb543526bdc6
-
SHA256
b93bf7971903fa60f1227cd3a86a7a33fd0e45ab04a73bf3ea35f4301dad4953
-
SHA512
22da9c2f09fdb68570ea5dd5d49c4b4ddb18b474021ccc9c6beff71bb73376dbaa5c9fec4ef6bb6cacec8b76037d42edc3dc59b73e02149436f2b52ff7b52475
-
SSDEEP
6144:wjfLxfn0TIkFb+aT3q6LS6jHLFdShYbSf7Dzl8gsweBX6Vmz2F0uTV5KuGx1oAia:iopTa6LS6jX2k6zlPs9Kz3gj7oATNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4464 9F0F.tmp 3920 9FAB.tmp 4372 A047.tmp 3892 A0F3.tmp 3112 A1AE.tmp 3840 A2A8.tmp 4728 A393.tmp 4580 A519.tmp 3256 A5C5.tmp 2488 A681.tmp 4848 A72D.tmp 4132 A7D9.tmp 3536 A875.tmp 652 A97E.tmp 2380 AA3A.tmp 4540 AAF5.tmp 1908 AB92.tmp 100 AC2E.tmp 4504 ACAB.tmp 2308 AD57.tmp 4348 AE60.tmp 864 AEED.tmp 1372 AF89.tmp 2476 B0B2.tmp 776 B15E.tmp 3064 B229.tmp 3612 B2C5.tmp 1852 B391.tmp 3012 B43C.tmp 5080 B4F8.tmp 4852 B5E2.tmp 4788 B69E.tmp 2436 B74A.tmp 4584 B7D6.tmp 4120 B873.tmp 728 B90F.tmp 1164 B9EA.tmp 3940 BA86.tmp 4260 BB22.tmp 512 BB9F.tmp 5096 BC4B.tmp 1560 BCE7.tmp 1636 BD64.tmp 4376 BDE1.tmp 3800 BE8D.tmp 1400 BF39.tmp 1444 BFC6.tmp 968 C052.tmp 1760 C0CF.tmp 564 C14C.tmp 4756 C1D9.tmp 2292 C285.tmp 900 C321.tmp 3184 C39E.tmp 4016 C42B.tmp 1136 C4B7.tmp 4984 C553.tmp 2908 C5E0.tmp 4464 C65D.tmp 4952 C6BB.tmp 996 C757.tmp 5088 C7D4.tmp 2324 C870.tmp 2696 C90D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 4464 2592 7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe 80 PID 2592 wrote to memory of 4464 2592 7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe 80 PID 2592 wrote to memory of 4464 2592 7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe 80 PID 4464 wrote to memory of 3920 4464 9F0F.tmp 81 PID 4464 wrote to memory of 3920 4464 9F0F.tmp 81 PID 4464 wrote to memory of 3920 4464 9F0F.tmp 81 PID 3920 wrote to memory of 4372 3920 9FAB.tmp 82 PID 3920 wrote to memory of 4372 3920 9FAB.tmp 82 PID 3920 wrote to memory of 4372 3920 9FAB.tmp 82 PID 4372 wrote to memory of 3892 4372 A047.tmp 83 PID 4372 wrote to memory of 3892 4372 A047.tmp 83 PID 4372 wrote to memory of 3892 4372 A047.tmp 83 PID 3892 wrote to memory of 3112 3892 A0F3.tmp 84 PID 3892 wrote to memory of 3112 3892 A0F3.tmp 84 PID 3892 wrote to memory of 3112 3892 A0F3.tmp 84 PID 3112 wrote to memory of 3840 3112 A1AE.tmp 85 PID 3112 wrote to memory of 3840 3112 A1AE.tmp 85 PID 3112 wrote to memory of 3840 3112 A1AE.tmp 85 PID 3840 wrote to memory of 4728 3840 A2A8.tmp 86 PID 3840 wrote to memory of 4728 3840 A2A8.tmp 86 PID 3840 wrote to memory of 4728 3840 A2A8.tmp 86 PID 4728 wrote to memory of 4580 4728 A393.tmp 87 PID 4728 wrote to memory of 4580 4728 A393.tmp 87 PID 4728 wrote to memory of 4580 4728 A393.tmp 87 PID 4580 wrote to memory of 3256 4580 A519.tmp 89 PID 4580 wrote to memory of 3256 4580 A519.tmp 89 PID 4580 wrote to memory of 3256 4580 A519.tmp 89 PID 3256 wrote to memory of 2488 3256 A5C5.tmp 90 PID 3256 wrote to memory of 2488 3256 A5C5.tmp 90 PID 3256 wrote to memory of 2488 3256 A5C5.tmp 90 PID 2488 wrote to memory of 4848 2488 A681.tmp 91 PID 2488 wrote to memory of 4848 2488 A681.tmp 91 PID 2488 wrote to memory of 4848 2488 A681.tmp 91 PID 4848 wrote to memory of 4132 4848 A72D.tmp 92 PID 4848 wrote to memory of 4132 4848 A72D.tmp 92 PID 4848 wrote to memory of 4132 4848 A72D.tmp 92 PID 4132 wrote to memory of 3536 4132 A7D9.tmp 93 PID 4132 wrote to memory of 3536 4132 A7D9.tmp 93 PID 4132 wrote to memory of 3536 4132 A7D9.tmp 93 PID 3536 wrote to memory of 652 3536 A875.tmp 94 PID 3536 wrote to memory of 652 3536 A875.tmp 94 PID 3536 wrote to memory of 652 3536 A875.tmp 94 PID 652 wrote to memory of 2380 652 A97E.tmp 95 PID 652 wrote to memory of 2380 652 A97E.tmp 95 PID 652 wrote to memory of 2380 652 A97E.tmp 95 PID 2380 wrote to memory of 4540 2380 AA3A.tmp 96 PID 2380 wrote to memory of 4540 2380 AA3A.tmp 96 PID 2380 wrote to memory of 4540 2380 AA3A.tmp 96 PID 4540 wrote to memory of 1908 4540 AAF5.tmp 97 PID 4540 wrote to memory of 1908 4540 AAF5.tmp 97 PID 4540 wrote to memory of 1908 4540 AAF5.tmp 97 PID 1908 wrote to memory of 100 1908 AB92.tmp 98 PID 1908 wrote to memory of 100 1908 AB92.tmp 98 PID 1908 wrote to memory of 100 1908 AB92.tmp 98 PID 100 wrote to memory of 4504 100 AC2E.tmp 101 PID 100 wrote to memory of 4504 100 AC2E.tmp 101 PID 100 wrote to memory of 4504 100 AC2E.tmp 101 PID 4504 wrote to memory of 2308 4504 ACAB.tmp 102 PID 4504 wrote to memory of 2308 4504 ACAB.tmp 102 PID 4504 wrote to memory of 2308 4504 ACAB.tmp 102 PID 2308 wrote to memory of 4348 2308 AD57.tmp 103 PID 2308 wrote to memory of 4348 2308 AD57.tmp 103 PID 2308 wrote to memory of 4348 2308 AD57.tmp 103 PID 4348 wrote to memory of 864 4348 AE60.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\7385d3778c85b11e8c185d624ac0d0e5_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"23⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"24⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"25⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"26⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"27⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"28⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"29⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"30⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"31⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"32⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"33⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"34⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"35⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"36⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"37⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"38⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"39⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"40⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"41⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"42⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"43⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"44⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"46⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"47⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"48⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"49⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"50⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"51⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"52⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"53⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"54⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"55⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"56⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"57⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"58⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"59⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"60⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"61⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"62⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"63⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"64⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"65⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"66⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"67⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"68⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"69⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"70⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"71⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"72⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\CD23.tmp"C:\Users\Admin\AppData\Local\Temp\CD23.tmp"73⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"74⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"75⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"76⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"77⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"78⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"79⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"80⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"81⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"82⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"83⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"84⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"85⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\D438.tmp"C:\Users\Admin\AppData\Local\Temp\D438.tmp"86⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"87⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"88⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"89⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"90⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"91⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"92⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\D774.tmp"C:\Users\Admin\AppData\Local\Temp\D774.tmp"93⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"94⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\D87E.tmp"C:\Users\Admin\AppData\Local\Temp\D87E.tmp"95⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"96⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"97⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"98⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"99⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"100⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"101⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"102⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"103⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"104⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"105⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\DE69.tmp"C:\Users\Admin\AppData\Local\Temp\DE69.tmp"106⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"107⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"108⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"109⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"110⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"111⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"112⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"113⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"114⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"115⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"116⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"117⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"118⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"120⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"121⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-