Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe
-
Size
520KB
-
MD5
3f82b31a42626c9a15600c36b4c64f72
-
SHA1
34507eb2ce29fd3fb7c30c93a36de87176a22973
-
SHA256
1e307a4325a0d7f32ef911ab1f59447a5bac7d127a78271efc081ae025084378
-
SHA512
c00e2760ace374ac8528fa6808e4d357cc822678925bf4f561944a34bb78392249700dbc478bf07a51502917c86459e50a66f216b13ebd1202df613d11c9a390
-
SSDEEP
12288:roRXOQjmOyuQ5r3JME8MMeeRUQ+8WkwdNNZ:rogQ9y34uveRqvdNN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4356 7DBB.tmp 5064 7E77.tmp 4820 7F52.tmp 3956 801D.tmp 4780 80E8.tmp 744 8194.tmp 1012 8230.tmp 4952 82DC.tmp 4136 8388.tmp 3564 8424.tmp 4604 84EF.tmp 4084 85BA.tmp 1276 8676.tmp 1612 8731.tmp 1152 882B.tmp 3212 8889.tmp 988 8916.tmp 1004 89F0.tmp 2804 8A8D.tmp 4516 8B58.tmp 1824 8BF4.tmp 3600 8CCF.tmp 5100 8DB9.tmp 2572 8E65.tmp 3988 8EF2.tmp 4068 8F9D.tmp 3700 901A.tmp 3148 90D6.tmp 4080 9163.tmp 3924 91EF.tmp 8 92E9.tmp 1988 93D4.tmp 5076 9470.tmp 2324 94FC.tmp 1252 955A.tmp 3348 95F6.tmp 2000 9693.tmp 468 972F.tmp 1584 97CB.tmp 4284 9867.tmp 2932 98E4.tmp 4852 9971.tmp 3752 99FE.tmp 2236 9A8A.tmp 888 9B07.tmp 3556 9BC3.tmp 4264 9C4F.tmp 4872 9CFB.tmp 4360 9DC6.tmp 4580 9E63.tmp 4868 9EFF.tmp 2388 9F8C.tmp 1384 A028.tmp 1108 A0B4.tmp 264 A160.tmp 2456 A1FD.tmp 5088 A27A.tmp 3896 A2F7.tmp 1308 A383.tmp 2268 A410.tmp 1480 A4AC.tmp 648 A548.tmp 1292 A5E5.tmp 3396 A662.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 4356 2628 3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe 81 PID 2628 wrote to memory of 4356 2628 3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe 81 PID 2628 wrote to memory of 4356 2628 3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe 81 PID 4356 wrote to memory of 5064 4356 7DBB.tmp 82 PID 4356 wrote to memory of 5064 4356 7DBB.tmp 82 PID 4356 wrote to memory of 5064 4356 7DBB.tmp 82 PID 5064 wrote to memory of 4820 5064 7E77.tmp 83 PID 5064 wrote to memory of 4820 5064 7E77.tmp 83 PID 5064 wrote to memory of 4820 5064 7E77.tmp 83 PID 4820 wrote to memory of 3956 4820 7F52.tmp 84 PID 4820 wrote to memory of 3956 4820 7F52.tmp 84 PID 4820 wrote to memory of 3956 4820 7F52.tmp 84 PID 3956 wrote to memory of 4780 3956 801D.tmp 85 PID 3956 wrote to memory of 4780 3956 801D.tmp 85 PID 3956 wrote to memory of 4780 3956 801D.tmp 85 PID 4780 wrote to memory of 744 4780 80E8.tmp 86 PID 4780 wrote to memory of 744 4780 80E8.tmp 86 PID 4780 wrote to memory of 744 4780 80E8.tmp 86 PID 744 wrote to memory of 1012 744 8194.tmp 87 PID 744 wrote to memory of 1012 744 8194.tmp 87 PID 744 wrote to memory of 1012 744 8194.tmp 87 PID 1012 wrote to memory of 4952 1012 8230.tmp 88 PID 1012 wrote to memory of 4952 1012 8230.tmp 88 PID 1012 wrote to memory of 4952 1012 8230.tmp 88 PID 4952 wrote to memory of 4136 4952 82DC.tmp 90 PID 4952 wrote to memory of 4136 4952 82DC.tmp 90 PID 4952 wrote to memory of 4136 4952 82DC.tmp 90 PID 4136 wrote to memory of 3564 4136 8388.tmp 91 PID 4136 wrote to memory of 3564 4136 8388.tmp 91 PID 4136 wrote to memory of 3564 4136 8388.tmp 91 PID 3564 wrote to memory of 4604 3564 8424.tmp 92 PID 3564 wrote to memory of 4604 3564 8424.tmp 92 PID 3564 wrote to memory of 4604 3564 8424.tmp 92 PID 4604 wrote to memory of 4084 4604 84EF.tmp 93 PID 4604 wrote to memory of 4084 4604 84EF.tmp 93 PID 4604 wrote to memory of 4084 4604 84EF.tmp 93 PID 4084 wrote to memory of 1276 4084 85BA.tmp 94 PID 4084 wrote to memory of 1276 4084 85BA.tmp 94 PID 4084 wrote to memory of 1276 4084 85BA.tmp 94 PID 1276 wrote to memory of 1612 1276 8676.tmp 95 PID 1276 wrote to memory of 1612 1276 8676.tmp 95 PID 1276 wrote to memory of 1612 1276 8676.tmp 95 PID 1612 wrote to memory of 1152 1612 8731.tmp 96 PID 1612 wrote to memory of 1152 1612 8731.tmp 96 PID 1612 wrote to memory of 1152 1612 8731.tmp 96 PID 1152 wrote to memory of 3212 1152 882B.tmp 97 PID 1152 wrote to memory of 3212 1152 882B.tmp 97 PID 1152 wrote to memory of 3212 1152 882B.tmp 97 PID 3212 wrote to memory of 988 3212 8889.tmp 98 PID 3212 wrote to memory of 988 3212 8889.tmp 98 PID 3212 wrote to memory of 988 3212 8889.tmp 98 PID 988 wrote to memory of 1004 988 8916.tmp 101 PID 988 wrote to memory of 1004 988 8916.tmp 101 PID 988 wrote to memory of 1004 988 8916.tmp 101 PID 1004 wrote to memory of 2804 1004 89F0.tmp 102 PID 1004 wrote to memory of 2804 1004 89F0.tmp 102 PID 1004 wrote to memory of 2804 1004 89F0.tmp 102 PID 2804 wrote to memory of 4516 2804 8A8D.tmp 103 PID 2804 wrote to memory of 4516 2804 8A8D.tmp 103 PID 2804 wrote to memory of 4516 2804 8A8D.tmp 103 PID 4516 wrote to memory of 1824 4516 8B58.tmp 104 PID 4516 wrote to memory of 1824 4516 8B58.tmp 104 PID 4516 wrote to memory of 1824 4516 8B58.tmp 104 PID 1824 wrote to memory of 3600 1824 8BF4.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\3f82b31a42626c9a15600c36b4c64f72_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"23⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"24⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"25⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"26⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"27⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"28⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"29⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"30⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"31⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"32⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"33⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"34⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"35⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"36⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"37⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"38⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"39⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"40⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"41⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"42⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"43⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"44⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"45⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"46⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"47⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"48⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"49⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"50⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"51⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"52⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"53⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"54⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"55⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"56⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"57⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"58⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"59⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"60⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"61⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"62⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"63⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"64⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"65⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"66⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"67⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"68⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"69⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"70⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"72⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"73⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"74⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"75⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"76⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"77⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"78⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"79⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"80⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"81⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"82⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"83⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"84⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"85⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"86⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"87⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"88⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"89⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"90⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"91⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"92⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"94⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"95⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"97⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"99⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"100⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"101⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"102⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"103⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"104⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"105⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"106⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"107⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"108⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"109⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"110⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"111⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"112⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"113⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"114⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"115⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"116⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"117⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"119⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"120⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"121⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"122⤵PID:3436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-