Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
848d482719827909cde6cf79d737864d_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
848d482719827909cde6cf79d737864d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
848d482719827909cde6cf79d737864d_mafia_JC.exe
-
Size
486KB
-
MD5
848d482719827909cde6cf79d737864d
-
SHA1
642d7b2455685676c7b24fdf395a71a22de3ecb9
-
SHA256
db8a17c2af685e43f70de24c123e8211e69277d91e71cd5e7b3a2b291d3acd88
-
SHA512
95f662143c2fd5eac67034287aa6f012ad6686a2beb562228e0f5aa8b2eb96be21f50c79ba032c89ce06c2c7f4eee5bfdb7e15023ba1c6dc2975b5775bc4ba01
-
SSDEEP
12288:UU5rCOTeiDPh5ftwq+23hqK8XDApd8/02acNZ:UUQOJD55fPYzCd8sgN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 948 8E75.tmp 1712 8F30.tmp 3056 8FBD.tmp 2284 90B7.tmp 5096 91B1.tmp 2712 924D.tmp 4940 9308.tmp 2580 93B4.tmp 2688 947F.tmp 3764 952B.tmp 3736 95A8.tmp 1420 9673.tmp 2172 97BC.tmp 3312 9887.tmp 5004 9923.tmp 4316 99DE.tmp 4644 9AC9.tmp 4188 9B84.tmp 636 9C4F.tmp 1440 9CCC.tmp 3672 9D88.tmp 4420 9E72.tmp 4984 9EFF.tmp 4288 9F9B.tmp 2364 A028.tmp 4728 A0E3.tmp 4276 A180.tmp 4360 A22B.tmp 2556 A2E7.tmp 1672 A3D1.tmp 3676 A4BC.tmp 932 A577.tmp 2224 A652.tmp 2692 A6FE.tmp 436 A79A.tmp 1324 A817.tmp 980 A8A4.tmp 1508 A940.tmp 3572 A9DC.tmp 2268 AA59.tmp 3424 AB05.tmp 5092 AB92.tmp 1120 AC3E.tmp 1660 ACCA.tmp 2188 AD76.tmp 4468 ADE3.tmp 1612 AE8F.tmp 4888 AF2C.tmp 3232 AFA9.tmp 4912 B045.tmp 2540 B0D1.tmp 1224 B15E.tmp 3492 B1EB.tmp 3356 B277.tmp 4012 B304.tmp 2700 B381.tmp 2476 B40E.tmp 2296 B49A.tmp 2388 B517.tmp 3752 B594.tmp 4044 B611.tmp 772 B66F.tmp 3720 B6CD.tmp 3828 B73A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 948 216 848d482719827909cde6cf79d737864d_mafia_JC.exe 81 PID 216 wrote to memory of 948 216 848d482719827909cde6cf79d737864d_mafia_JC.exe 81 PID 216 wrote to memory of 948 216 848d482719827909cde6cf79d737864d_mafia_JC.exe 81 PID 948 wrote to memory of 1712 948 8E75.tmp 82 PID 948 wrote to memory of 1712 948 8E75.tmp 82 PID 948 wrote to memory of 1712 948 8E75.tmp 82 PID 1712 wrote to memory of 3056 1712 8F30.tmp 83 PID 1712 wrote to memory of 3056 1712 8F30.tmp 83 PID 1712 wrote to memory of 3056 1712 8F30.tmp 83 PID 3056 wrote to memory of 2284 3056 8FBD.tmp 84 PID 3056 wrote to memory of 2284 3056 8FBD.tmp 84 PID 3056 wrote to memory of 2284 3056 8FBD.tmp 84 PID 2284 wrote to memory of 5096 2284 90B7.tmp 85 PID 2284 wrote to memory of 5096 2284 90B7.tmp 85 PID 2284 wrote to memory of 5096 2284 90B7.tmp 85 PID 5096 wrote to memory of 2712 5096 91B1.tmp 86 PID 5096 wrote to memory of 2712 5096 91B1.tmp 86 PID 5096 wrote to memory of 2712 5096 91B1.tmp 86 PID 2712 wrote to memory of 4940 2712 924D.tmp 87 PID 2712 wrote to memory of 4940 2712 924D.tmp 87 PID 2712 wrote to memory of 4940 2712 924D.tmp 87 PID 4940 wrote to memory of 2580 4940 9308.tmp 88 PID 4940 wrote to memory of 2580 4940 9308.tmp 88 PID 4940 wrote to memory of 2580 4940 9308.tmp 88 PID 2580 wrote to memory of 2688 2580 93B4.tmp 89 PID 2580 wrote to memory of 2688 2580 93B4.tmp 89 PID 2580 wrote to memory of 2688 2580 93B4.tmp 89 PID 2688 wrote to memory of 3764 2688 947F.tmp 90 PID 2688 wrote to memory of 3764 2688 947F.tmp 90 PID 2688 wrote to memory of 3764 2688 947F.tmp 90 PID 3764 wrote to memory of 3736 3764 952B.tmp 91 PID 3764 wrote to memory of 3736 3764 952B.tmp 91 PID 3764 wrote to memory of 3736 3764 952B.tmp 91 PID 3736 wrote to memory of 1420 3736 95A8.tmp 92 PID 3736 wrote to memory of 1420 3736 95A8.tmp 92 PID 3736 wrote to memory of 1420 3736 95A8.tmp 92 PID 1420 wrote to memory of 2172 1420 9673.tmp 93 PID 1420 wrote to memory of 2172 1420 9673.tmp 93 PID 1420 wrote to memory of 2172 1420 9673.tmp 93 PID 2172 wrote to memory of 3312 2172 97BC.tmp 94 PID 2172 wrote to memory of 3312 2172 97BC.tmp 94 PID 2172 wrote to memory of 3312 2172 97BC.tmp 94 PID 3312 wrote to memory of 5004 3312 9887.tmp 97 PID 3312 wrote to memory of 5004 3312 9887.tmp 97 PID 3312 wrote to memory of 5004 3312 9887.tmp 97 PID 5004 wrote to memory of 4316 5004 9923.tmp 98 PID 5004 wrote to memory of 4316 5004 9923.tmp 98 PID 5004 wrote to memory of 4316 5004 9923.tmp 98 PID 4316 wrote to memory of 4644 4316 99DE.tmp 99 PID 4316 wrote to memory of 4644 4316 99DE.tmp 99 PID 4316 wrote to memory of 4644 4316 99DE.tmp 99 PID 4644 wrote to memory of 4188 4644 9AC9.tmp 100 PID 4644 wrote to memory of 4188 4644 9AC9.tmp 100 PID 4644 wrote to memory of 4188 4644 9AC9.tmp 100 PID 4188 wrote to memory of 636 4188 9B84.tmp 101 PID 4188 wrote to memory of 636 4188 9B84.tmp 101 PID 4188 wrote to memory of 636 4188 9B84.tmp 101 PID 636 wrote to memory of 1440 636 9C4F.tmp 102 PID 636 wrote to memory of 1440 636 9C4F.tmp 102 PID 636 wrote to memory of 1440 636 9C4F.tmp 102 PID 1440 wrote to memory of 3672 1440 9CCC.tmp 104 PID 1440 wrote to memory of 3672 1440 9CCC.tmp 104 PID 1440 wrote to memory of 3672 1440 9CCC.tmp 104 PID 3672 wrote to memory of 4420 3672 9D88.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\848d482719827909cde6cf79d737864d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\848d482719827909cde6cf79d737864d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"23⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"24⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"25⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"26⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"27⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"28⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"29⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"30⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"31⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"32⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"33⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"34⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"35⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"36⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"37⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"38⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"39⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"40⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"41⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"42⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"43⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"44⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"45⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"46⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"47⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"48⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"49⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"50⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"51⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"52⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"53⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"54⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"55⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"56⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"57⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"58⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"59⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"60⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"61⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"62⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"63⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"64⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"65⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"66⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"67⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"68⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"69⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"70⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"71⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"72⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"73⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"74⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"75⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"76⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"77⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"78⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"79⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"80⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"81⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"82⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"83⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"84⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"85⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"86⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"87⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"88⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"89⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"90⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"91⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"92⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"93⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"94⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"95⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"96⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"97⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"98⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"99⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"100⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"101⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"102⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"103⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"104⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"105⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"106⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"107⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"108⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"109⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"110⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"111⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"112⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"113⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"114⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"115⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"116⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"117⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"118⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"119⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"120⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"121⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"122⤵PID:4660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-