Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe
-
Size
487KB
-
MD5
4852a72eadacb2efad66ff3297f35d7b
-
SHA1
b7fa8a0ea06b47ce38f223334c1b61e3c2cc1b77
-
SHA256
d58f92b001beef67f1699ab0787d186cdb3bc99e461a35385bae2a4203d0ca29
-
SHA512
6251ce654a2a82a3961dd9f255d407511e263e539426613a8434bd598adacc3fe1ae5673cdfc1fa275680edcfb6845a736e0edb9f18c1f530c67220122528124
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxdG6t/y6yzG5aqIXfLgQb8DpxW691+4/hnUAX:yU5rCOTeiN3tBFofLtapxW63vNbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3392 D15A.tmp 2308 D225.tmp 264 D2E0.tmp 840 D3AB.tmp 468 D486.tmp 1520 D580.tmp 3784 D61C.tmp 1088 D6B9.tmp 3988 D755.tmp 4768 D86E.tmp 1736 D91A.tmp 4008 D9D5.tmp 216 DA91.tmp 3308 DB4C.tmp 4112 DBF8.tmp 4804 DC75.tmp 1172 DD31.tmp 1528 DE0C.tmp 660 DF06.tmp 3764 DFD1.tmp 4488 E0CB.tmp 1960 E167.tmp 3100 E203.tmp 2428 E2DE.tmp 3632 E3A9.tmp 3520 E4A3.tmp 2748 E54F.tmp 4280 E639.tmp 4656 E6F5.tmp 4148 E7A1.tmp 1492 E83D.tmp 4636 E8F8.tmp 4964 E985.tmp 1860 E9F2.tmp 3536 EA60.tmp 420 EAEC.tmp 4440 EB5A.tmp 2972 EBF6.tmp 1628 EC63.tmp 3180 ED00.tmp 4048 ED7D.tmp 3336 EE09.tmp 4524 EE96.tmp 3648 EF42.tmp 4404 EFFD.tmp 2692 F08A.tmp 5044 F117.tmp 4376 F1A3.tmp 500 F220.tmp 2744 F29D.tmp 848 F31A.tmp 3664 F397.tmp 3712 F405.tmp 5056 F491.tmp 5076 F4FF.tmp 580 F57C.tmp 3316 F5F9.tmp 2184 F6B4.tmp 4864 F750.tmp 1948 F7BE.tmp 760 F84A.tmp 468 F8E7.tmp 1148 F983.tmp 2136 FA5E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5076 wrote to memory of 3392 5076 4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe 82 PID 5076 wrote to memory of 3392 5076 4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe 82 PID 5076 wrote to memory of 3392 5076 4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe 82 PID 3392 wrote to memory of 2308 3392 D15A.tmp 83 PID 3392 wrote to memory of 2308 3392 D15A.tmp 83 PID 3392 wrote to memory of 2308 3392 D15A.tmp 83 PID 2308 wrote to memory of 264 2308 D225.tmp 84 PID 2308 wrote to memory of 264 2308 D225.tmp 84 PID 2308 wrote to memory of 264 2308 D225.tmp 84 PID 264 wrote to memory of 840 264 D2E0.tmp 85 PID 264 wrote to memory of 840 264 D2E0.tmp 85 PID 264 wrote to memory of 840 264 D2E0.tmp 85 PID 840 wrote to memory of 468 840 D3AB.tmp 86 PID 840 wrote to memory of 468 840 D3AB.tmp 86 PID 840 wrote to memory of 468 840 D3AB.tmp 86 PID 468 wrote to memory of 1520 468 D486.tmp 87 PID 468 wrote to memory of 1520 468 D486.tmp 87 PID 468 wrote to memory of 1520 468 D486.tmp 87 PID 1520 wrote to memory of 3784 1520 D580.tmp 88 PID 1520 wrote to memory of 3784 1520 D580.tmp 88 PID 1520 wrote to memory of 3784 1520 D580.tmp 88 PID 3784 wrote to memory of 1088 3784 D61C.tmp 89 PID 3784 wrote to memory of 1088 3784 D61C.tmp 89 PID 3784 wrote to memory of 1088 3784 D61C.tmp 89 PID 1088 wrote to memory of 3988 1088 D6B9.tmp 90 PID 1088 wrote to memory of 3988 1088 D6B9.tmp 90 PID 1088 wrote to memory of 3988 1088 D6B9.tmp 90 PID 3988 wrote to memory of 4768 3988 D755.tmp 92 PID 3988 wrote to memory of 4768 3988 D755.tmp 92 PID 3988 wrote to memory of 4768 3988 D755.tmp 92 PID 4768 wrote to memory of 1736 4768 D86E.tmp 93 PID 4768 wrote to memory of 1736 4768 D86E.tmp 93 PID 4768 wrote to memory of 1736 4768 D86E.tmp 93 PID 1736 wrote to memory of 4008 1736 D91A.tmp 94 PID 1736 wrote to memory of 4008 1736 D91A.tmp 94 PID 1736 wrote to memory of 4008 1736 D91A.tmp 94 PID 4008 wrote to memory of 216 4008 D9D5.tmp 95 PID 4008 wrote to memory of 216 4008 D9D5.tmp 95 PID 4008 wrote to memory of 216 4008 D9D5.tmp 95 PID 216 wrote to memory of 3308 216 DA91.tmp 96 PID 216 wrote to memory of 3308 216 DA91.tmp 96 PID 216 wrote to memory of 3308 216 DA91.tmp 96 PID 3308 wrote to memory of 4112 3308 DB4C.tmp 97 PID 3308 wrote to memory of 4112 3308 DB4C.tmp 97 PID 3308 wrote to memory of 4112 3308 DB4C.tmp 97 PID 4112 wrote to memory of 4804 4112 DBF8.tmp 98 PID 4112 wrote to memory of 4804 4112 DBF8.tmp 98 PID 4112 wrote to memory of 4804 4112 DBF8.tmp 98 PID 4804 wrote to memory of 1172 4804 DC75.tmp 99 PID 4804 wrote to memory of 1172 4804 DC75.tmp 99 PID 4804 wrote to memory of 1172 4804 DC75.tmp 99 PID 1172 wrote to memory of 1528 1172 DD31.tmp 100 PID 1172 wrote to memory of 1528 1172 DD31.tmp 100 PID 1172 wrote to memory of 1528 1172 DD31.tmp 100 PID 1528 wrote to memory of 660 1528 DE0C.tmp 101 PID 1528 wrote to memory of 660 1528 DE0C.tmp 101 PID 1528 wrote to memory of 660 1528 DE0C.tmp 101 PID 660 wrote to memory of 3764 660 DF06.tmp 102 PID 660 wrote to memory of 3764 660 DF06.tmp 102 PID 660 wrote to memory of 3764 660 DF06.tmp 102 PID 3764 wrote to memory of 4488 3764 DFD1.tmp 103 PID 3764 wrote to memory of 4488 3764 DFD1.tmp 103 PID 3764 wrote to memory of 4488 3764 DFD1.tmp 103 PID 4488 wrote to memory of 1960 4488 E0CB.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4852a72eadacb2efad66ff3297f35d7b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D61C.tmp"C:\Users\Admin\AppData\Local\Temp\D61C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"23⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"24⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"25⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"C:\Users\Admin\AppData\Local\Temp\E3A9.tmp"26⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"27⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"28⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"29⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"30⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"31⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"32⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"33⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"34⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"35⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"36⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"37⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"38⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"39⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"40⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"41⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"42⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\EE09.tmp"C:\Users\Admin\AppData\Local\Temp\EE09.tmp"43⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"44⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"45⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"46⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"47⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"48⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"49⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"50⤵
- Executes dropped EXE
PID:500 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"51⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"52⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"53⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"54⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\F491.tmp"C:\Users\Admin\AppData\Local\Temp\F491.tmp"55⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"56⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"57⤵
- Executes dropped EXE
PID:580 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"58⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"59⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"60⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"61⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"62⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"63⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"64⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"65⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"66⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"67⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"68⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"69⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"70⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"71⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"72⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"73⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"74⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"75⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"76⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"77⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"78⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"79⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"80⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"81⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"82⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"83⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"84⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"85⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"86⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"87⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"88⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"89⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"90⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"91⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"92⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"93⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"94⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"95⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"96⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"97⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"98⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"99⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"100⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"101⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"102⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"103⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"104⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"105⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"106⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"107⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\1141.tmp"C:\Users\Admin\AppData\Local\Temp\1141.tmp"108⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\11BE.tmp"C:\Users\Admin\AppData\Local\Temp\11BE.tmp"109⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"110⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"111⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"112⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"113⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"114⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"115⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"116⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"117⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"118⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"119⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"120⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"121⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"122⤵PID:4952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-