Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
66c953073272db0b3b0c210540d6379f_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
66c953073272db0b3b0c210540d6379f_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
66c953073272db0b3b0c210540d6379f_mafia_JC.exe
-
Size
487KB
-
MD5
66c953073272db0b3b0c210540d6379f
-
SHA1
06eb37e2a1ce96fe6a2914dbcdad274b34135359
-
SHA256
1b6d95a4c571b2d6b4218cb896e9cfd4de70bd653b56ee4b38e5820f49afb9d8
-
SHA512
cf38a3c85d95d2677fd026826f26dca84ba660b1ee3e9a667d29955f4d3fa93aa24ce22e3a86141d1be6c2069ae480f5b360f71cf486cd2d30b71099108fc8db
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxpglEbOPLUiIAKgnWdNpGw+JeF4MMzZGDE+ko:yU5rCOTeiNqYiYNpGw+E+34w+kUbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1512 FC61.tmp 4168 FD0D.tmp 1372 FDF7.tmp 2284 FF6E.tmp 2020 2A.tmp 5076 F5.tmp 2628 8C5.tmp 2748 9CF.tmp 1592 A7B.tmp 4144 B36.tmp 1476 BF2.tmp 2920 CCC.tmp 440 DB7.tmp 4944 EB1.tmp 2292 F8B.tmp 2768 1095.tmp 3316 1170.tmp 3448 123B.tmp 4600 1335.tmp 2988 143F.tmp 3476 1558.tmp 2844 1623.tmp 1468 16EE.tmp 808 17C9.tmp 2840 1865.tmp 2304 1921.tmp 996 19EC.tmp 1504 1BB1.tmp 1932 1CCA.tmp 3260 1DC4.tmp 212 1E8F.tmp 1236 1F4B.tmp 2124 2045.tmp 4112 2100.tmp 4784 219C.tmp 3836 2248.tmp 1220 2304.tmp 4972 23B0.tmp 4876 246B.tmp 2504 2584.tmp 4732 2630.tmp 4508 26DC.tmp 5100 2788.tmp 3424 2844.tmp 2992 28EF.tmp 1556 299B.tmp 2588 2A47.tmp 4264 2B03.tmp 424 2B9F.tmp 5052 2C4B.tmp 3908 2CE7.tmp 4392 2DA3.tmp 1784 2E4E.tmp 1812 2ECB.tmp 1372 2F58.tmp 2020 2FF4.tmp 2316 3091.tmp 2488 310E.tmp 2500 31C9.tmp 464 3256.tmp 2892 3330.tmp 4144 33CD.tmp 744 3479.tmp 3428 3534.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1512 1656 66c953073272db0b3b0c210540d6379f_mafia_JC.exe 82 PID 1656 wrote to memory of 1512 1656 66c953073272db0b3b0c210540d6379f_mafia_JC.exe 82 PID 1656 wrote to memory of 1512 1656 66c953073272db0b3b0c210540d6379f_mafia_JC.exe 82 PID 1512 wrote to memory of 4168 1512 FC61.tmp 83 PID 1512 wrote to memory of 4168 1512 FC61.tmp 83 PID 1512 wrote to memory of 4168 1512 FC61.tmp 83 PID 4168 wrote to memory of 1372 4168 FD0D.tmp 84 PID 4168 wrote to memory of 1372 4168 FD0D.tmp 84 PID 4168 wrote to memory of 1372 4168 FD0D.tmp 84 PID 1372 wrote to memory of 2284 1372 FDF7.tmp 85 PID 1372 wrote to memory of 2284 1372 FDF7.tmp 85 PID 1372 wrote to memory of 2284 1372 FDF7.tmp 85 PID 2284 wrote to memory of 2020 2284 FF6E.tmp 86 PID 2284 wrote to memory of 2020 2284 FF6E.tmp 86 PID 2284 wrote to memory of 2020 2284 FF6E.tmp 86 PID 2020 wrote to memory of 5076 2020 2A.tmp 87 PID 2020 wrote to memory of 5076 2020 2A.tmp 87 PID 2020 wrote to memory of 5076 2020 2A.tmp 87 PID 5076 wrote to memory of 2628 5076 F5.tmp 88 PID 5076 wrote to memory of 2628 5076 F5.tmp 88 PID 5076 wrote to memory of 2628 5076 F5.tmp 88 PID 2628 wrote to memory of 2748 2628 8C5.tmp 89 PID 2628 wrote to memory of 2748 2628 8C5.tmp 89 PID 2628 wrote to memory of 2748 2628 8C5.tmp 89 PID 2748 wrote to memory of 1592 2748 9CF.tmp 90 PID 2748 wrote to memory of 1592 2748 9CF.tmp 90 PID 2748 wrote to memory of 1592 2748 9CF.tmp 90 PID 1592 wrote to memory of 4144 1592 A7B.tmp 92 PID 1592 wrote to memory of 4144 1592 A7B.tmp 92 PID 1592 wrote to memory of 4144 1592 A7B.tmp 92 PID 4144 wrote to memory of 1476 4144 B36.tmp 93 PID 4144 wrote to memory of 1476 4144 B36.tmp 93 PID 4144 wrote to memory of 1476 4144 B36.tmp 93 PID 1476 wrote to memory of 2920 1476 BF2.tmp 94 PID 1476 wrote to memory of 2920 1476 BF2.tmp 94 PID 1476 wrote to memory of 2920 1476 BF2.tmp 94 PID 2920 wrote to memory of 440 2920 CCC.tmp 95 PID 2920 wrote to memory of 440 2920 CCC.tmp 95 PID 2920 wrote to memory of 440 2920 CCC.tmp 95 PID 440 wrote to memory of 4944 440 DB7.tmp 96 PID 440 wrote to memory of 4944 440 DB7.tmp 96 PID 440 wrote to memory of 4944 440 DB7.tmp 96 PID 4944 wrote to memory of 2292 4944 EB1.tmp 97 PID 4944 wrote to memory of 2292 4944 EB1.tmp 97 PID 4944 wrote to memory of 2292 4944 EB1.tmp 97 PID 2292 wrote to memory of 2768 2292 F8B.tmp 98 PID 2292 wrote to memory of 2768 2292 F8B.tmp 98 PID 2292 wrote to memory of 2768 2292 F8B.tmp 98 PID 2768 wrote to memory of 3316 2768 1095.tmp 101 PID 2768 wrote to memory of 3316 2768 1095.tmp 101 PID 2768 wrote to memory of 3316 2768 1095.tmp 101 PID 3316 wrote to memory of 3448 3316 1170.tmp 102 PID 3316 wrote to memory of 3448 3316 1170.tmp 102 PID 3316 wrote to memory of 3448 3316 1170.tmp 102 PID 3448 wrote to memory of 4600 3448 123B.tmp 103 PID 3448 wrote to memory of 4600 3448 123B.tmp 103 PID 3448 wrote to memory of 4600 3448 123B.tmp 103 PID 4600 wrote to memory of 2988 4600 1335.tmp 104 PID 4600 wrote to memory of 2988 4600 1335.tmp 104 PID 4600 wrote to memory of 2988 4600 1335.tmp 104 PID 2988 wrote to memory of 3476 2988 143F.tmp 105 PID 2988 wrote to memory of 3476 2988 143F.tmp 105 PID 2988 wrote to memory of 3476 2988 143F.tmp 105 PID 3476 wrote to memory of 2844 3476 1558.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\66c953073272db0b3b0c210540d6379f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\66c953073272db0b3b0c210540d6379f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\143F.tmp"C:\Users\Admin\AppData\Local\Temp\143F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"23⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"24⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"25⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\1865.tmp"C:\Users\Admin\AppData\Local\Temp\1865.tmp"26⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"27⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"28⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"29⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"30⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"31⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"32⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"33⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"34⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"35⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"36⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"37⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"38⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"39⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"40⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"41⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"42⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"43⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"44⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\2844.tmp"C:\Users\Admin\AppData\Local\Temp\2844.tmp"45⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"46⤵
- Executes dropped EXE
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"47⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"48⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"49⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"50⤵
- Executes dropped EXE
PID:424 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"51⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"52⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"53⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"54⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"55⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"56⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"57⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"58⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"59⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"60⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"61⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"62⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"63⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"64⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"65⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"66⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\363E.tmp"C:\Users\Admin\AppData\Local\Temp\363E.tmp"67⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"68⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"69⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"70⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"71⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"72⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"73⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"74⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"75⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"76⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"77⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"78⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"79⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"80⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"81⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"82⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"83⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"84⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"85⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"86⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"87⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"88⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"89⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"90⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"91⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"92⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"93⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"94⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"95⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"96⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"97⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"99⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"100⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"101⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"102⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"103⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"104⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"105⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"106⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"107⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"108⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\4F34.tmp"C:\Users\Admin\AppData\Local\Temp\4F34.tmp"109⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"111⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"112⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"113⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"114⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"115⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"116⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"117⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"118⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"120⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"121⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-