Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 15:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe
-
Size
486KB
-
MD5
160eff4d643e7d1fb4c8c540420c02df
-
SHA1
81490f4f96ad47d5020b693104dca4366a5756b6
-
SHA256
2ab38880bbf267aacc0d28b6d875e23c268a933d4e5c5cb062abe1bcfeb52a01
-
SHA512
5ac331cd4859081d8f3e9c624243668fc4ef7da57113582271e92ea3d76805c9900c6fe85adc5fd76bf036e5e817f1ebddbc293e657a98411c4d8893cec4fe55
-
SSDEEP
12288:/U5rCOTeiDPHifgj5e8bmC/hYSadPj1vSNZ:/UQOJDPHif63YtcN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3768 CFF2.tmp 2712 D0EC.tmp 1944 D188.tmp 3212 D263.tmp 1800 D34E.tmp 4760 D409.tmp 2772 D496.tmp 4608 D542.tmp 3388 D65B.tmp 1644 D726.tmp 2096 D7B3.tmp 3912 D8AD.tmp 4668 D9B6.tmp 860 DB0E.tmp 4564 DBAA.tmp 4380 DC46.tmp 3288 DCF2.tmp 1128 DE3A.tmp 2364 DF15.tmp 1044 DFB1.tmp 1592 E04E.tmp 3584 E128.tmp 948 E1C5.tmp 3468 E242.tmp 2248 E30D.tmp 4436 E3D8.tmp 640 E4A3.tmp 4384 E53F.tmp 3788 E5FB.tmp 4180 E6B6.tmp 1976 E772.tmp 3996 E83D.tmp 3644 E8D9.tmp 3964 E995.tmp 400 EA31.tmp 3952 EADD.tmp 3712 EB69.tmp 4956 EC15.tmp 1964 ECB2.tmp 4724 ED3E.tmp 4144 EDCB.tmp 752 EE57.tmp 1016 EED4.tmp 2108 EF51.tmp 3736 EFFD.tmp 3832 F09A.tmp 4492 F126.tmp 4440 F1A3.tmp 500 F230.tmp 1324 F2AD.tmp 4188 F359.tmp 5116 F3D6.tmp 1940 F453.tmp 2788 F4FF.tmp 64 F59B.tmp 5108 F637.tmp 1796 F6B4.tmp 4156 F741.tmp 408 F7DD.tmp 1808 F86A.tmp 3940 F8F6.tmp 2876 F9A2.tmp 2636 FA3E.tmp 116 FAEA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 3768 4368 160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe 80 PID 4368 wrote to memory of 3768 4368 160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe 80 PID 4368 wrote to memory of 3768 4368 160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe 80 PID 3768 wrote to memory of 2712 3768 CFF2.tmp 81 PID 3768 wrote to memory of 2712 3768 CFF2.tmp 81 PID 3768 wrote to memory of 2712 3768 CFF2.tmp 81 PID 2712 wrote to memory of 1944 2712 D0EC.tmp 82 PID 2712 wrote to memory of 1944 2712 D0EC.tmp 82 PID 2712 wrote to memory of 1944 2712 D0EC.tmp 82 PID 1944 wrote to memory of 3212 1944 D188.tmp 83 PID 1944 wrote to memory of 3212 1944 D188.tmp 83 PID 1944 wrote to memory of 3212 1944 D188.tmp 83 PID 3212 wrote to memory of 1800 3212 D263.tmp 84 PID 3212 wrote to memory of 1800 3212 D263.tmp 84 PID 3212 wrote to memory of 1800 3212 D263.tmp 84 PID 1800 wrote to memory of 4760 1800 D34E.tmp 85 PID 1800 wrote to memory of 4760 1800 D34E.tmp 85 PID 1800 wrote to memory of 4760 1800 D34E.tmp 85 PID 4760 wrote to memory of 2772 4760 D409.tmp 86 PID 4760 wrote to memory of 2772 4760 D409.tmp 86 PID 4760 wrote to memory of 2772 4760 D409.tmp 86 PID 2772 wrote to memory of 4608 2772 D496.tmp 87 PID 2772 wrote to memory of 4608 2772 D496.tmp 87 PID 2772 wrote to memory of 4608 2772 D496.tmp 87 PID 4608 wrote to memory of 3388 4608 D542.tmp 88 PID 4608 wrote to memory of 3388 4608 D542.tmp 88 PID 4608 wrote to memory of 3388 4608 D542.tmp 88 PID 3388 wrote to memory of 1644 3388 D65B.tmp 90 PID 3388 wrote to memory of 1644 3388 D65B.tmp 90 PID 3388 wrote to memory of 1644 3388 D65B.tmp 90 PID 1644 wrote to memory of 2096 1644 D726.tmp 91 PID 1644 wrote to memory of 2096 1644 D726.tmp 91 PID 1644 wrote to memory of 2096 1644 D726.tmp 91 PID 2096 wrote to memory of 3912 2096 D7B3.tmp 92 PID 2096 wrote to memory of 3912 2096 D7B3.tmp 92 PID 2096 wrote to memory of 3912 2096 D7B3.tmp 92 PID 3912 wrote to memory of 4668 3912 D8AD.tmp 93 PID 3912 wrote to memory of 4668 3912 D8AD.tmp 93 PID 3912 wrote to memory of 4668 3912 D8AD.tmp 93 PID 4668 wrote to memory of 860 4668 D9B6.tmp 94 PID 4668 wrote to memory of 860 4668 D9B6.tmp 94 PID 4668 wrote to memory of 860 4668 D9B6.tmp 94 PID 860 wrote to memory of 4564 860 DB0E.tmp 95 PID 860 wrote to memory of 4564 860 DB0E.tmp 95 PID 860 wrote to memory of 4564 860 DB0E.tmp 95 PID 4564 wrote to memory of 4380 4564 DBAA.tmp 96 PID 4564 wrote to memory of 4380 4564 DBAA.tmp 96 PID 4564 wrote to memory of 4380 4564 DBAA.tmp 96 PID 4380 wrote to memory of 3288 4380 DC46.tmp 97 PID 4380 wrote to memory of 3288 4380 DC46.tmp 97 PID 4380 wrote to memory of 3288 4380 DC46.tmp 97 PID 3288 wrote to memory of 1128 3288 DCF2.tmp 98 PID 3288 wrote to memory of 1128 3288 DCF2.tmp 98 PID 3288 wrote to memory of 1128 3288 DCF2.tmp 98 PID 1128 wrote to memory of 2364 1128 DE3A.tmp 99 PID 1128 wrote to memory of 2364 1128 DE3A.tmp 99 PID 1128 wrote to memory of 2364 1128 DE3A.tmp 99 PID 2364 wrote to memory of 1044 2364 DF15.tmp 100 PID 2364 wrote to memory of 1044 2364 DF15.tmp 100 PID 2364 wrote to memory of 1044 2364 DF15.tmp 100 PID 1044 wrote to memory of 1592 1044 DFB1.tmp 101 PID 1044 wrote to memory of 1592 1044 DFB1.tmp 101 PID 1044 wrote to memory of 1592 1044 DFB1.tmp 101 PID 1592 wrote to memory of 3584 1592 E04E.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\160eff4d643e7d1fb4c8c540420c02df_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\D496.tmp"C:\Users\Admin\AppData\Local\Temp\D496.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\D65B.tmp"C:\Users\Admin\AppData\Local\Temp\D65B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"23⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"24⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"25⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"26⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"C:\Users\Admin\AppData\Local\Temp\E3D8.tmp"27⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"28⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"29⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"30⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"31⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"32⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"33⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"34⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"35⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"36⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\EADD.tmp"C:\Users\Admin\AppData\Local\Temp\EADD.tmp"37⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"38⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"39⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"C:\Users\Admin\AppData\Local\Temp\ECB2.tmp"40⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"41⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"42⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"43⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"44⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"45⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"46⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"47⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"48⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"49⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"50⤵
- Executes dropped EXE
PID:500 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"51⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"52⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"C:\Users\Admin\AppData\Local\Temp\F3D6.tmp"53⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"54⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"55⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"56⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\F637.tmp"C:\Users\Admin\AppData\Local\Temp\F637.tmp"57⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"58⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"59⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"60⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"61⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"62⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"63⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"64⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"65⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"66⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"67⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"68⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"69⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"70⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"71⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"72⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"73⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"74⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"75⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"76⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"77⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"78⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"79⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"80⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"81⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"82⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"83⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"84⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"85⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"86⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"87⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"88⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"89⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"90⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"91⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"92⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"93⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"94⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"95⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"96⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"97⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"98⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"99⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"100⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"101⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"102⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"103⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"104⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"105⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"106⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"107⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"108⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"109⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"110⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"111⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"112⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"113⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"114⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\15A6.tmp"C:\Users\Admin\AppData\Local\Temp\15A6.tmp"115⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"116⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"117⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"118⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"119⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"120⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"121⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"122⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-