Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe
Resource
win10v2004-20230824-en
General
-
Target
aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe
-
Size
488KB
-
MD5
aa983393e13e1a48c86e17fa3a41cd91
-
SHA1
4e0a8415d34fd57b43d3284c21d5774de784d20b
-
SHA256
cd4756e9052a0559969ca223d8913212945ec4c08373a59a44caf83340ed4023
-
SHA512
f180b6b99ce8a8d2f240ac4120505d0c2d7b92196eb51e5293163784e0bd4e34c83d87d808400950bdb7de4f0bff1a44f290b4a80dbf92ffd7e82ebe0c56cb35
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7poJu16sIuCth8MIJB8tlHzDFHeiR1sH3dZ:/U5rCOTeiDqJu1VIkMIJB8jUNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 652 B49A.tmp 724 C071.tmp 5012 C0FE.tmp 1156 C208.tmp 216 C294.tmp 344 C350.tmp 4552 C3EC.tmp 2068 C505.tmp 4796 C60F.tmp 4868 C709.tmp 2028 C7D4.tmp 232 C89F.tmp 1576 C9B8.tmp 3288 CAA3.tmp 3736 CB5E.tmp 1632 CCB6.tmp 1436 CD43.tmp 1752 CDEF.tmp 2880 CE7B.tmp 4264 CF17.tmp 3400 CFA4.tmp 4940 D060.tmp 2792 D13A.tmp 1520 D1D7.tmp 3336 D273.tmp 3996 D33E.tmp 1840 D3DA.tmp 1900 D467.tmp 904 D522.tmp 972 D5ED.tmp 3648 D68A.tmp 3780 D745.tmp 2900 D7D2.tmp 3512 D86E.tmp 2848 D8EB.tmp 3920 D968.tmp 1792 DA04.tmp 1860 DACF.tmp 1772 DB7B.tmp 1396 DC27.tmp 4944 DCA4.tmp 236 DD40.tmp 2136 DDCD.tmp 452 DE5A.tmp 3796 DEC7.tmp 984 DF63.tmp 3712 DFF0.tmp 576 E08C.tmp 3468 E138.tmp 384 E1B5.tmp 868 E242.tmp 4752 E2DE.tmp 3188 E34B.tmp 2744 E3C8.tmp 344 E445.tmp 4604 E4E2.tmp 5088 E54F.tmp 2068 E5EB.tmp 4732 E687.tmp 4800 E714.tmp 2760 E7A1.tmp 216 E84D.tmp 2232 E908.tmp 4456 E9B4.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{FEA0A5B4-64E1-4ABB-8B04-2C4904B3C8E4}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3712 wrote to memory of 652 3712 aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe 85 PID 3712 wrote to memory of 652 3712 aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe 85 PID 3712 wrote to memory of 652 3712 aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe 85 PID 652 wrote to memory of 724 652 B49A.tmp 86 PID 652 wrote to memory of 724 652 B49A.tmp 86 PID 652 wrote to memory of 724 652 B49A.tmp 86 PID 724 wrote to memory of 5012 724 C071.tmp 87 PID 724 wrote to memory of 5012 724 C071.tmp 87 PID 724 wrote to memory of 5012 724 C071.tmp 87 PID 5012 wrote to memory of 1156 5012 C0FE.tmp 88 PID 5012 wrote to memory of 1156 5012 C0FE.tmp 88 PID 5012 wrote to memory of 1156 5012 C0FE.tmp 88 PID 1156 wrote to memory of 216 1156 C208.tmp 89 PID 1156 wrote to memory of 216 1156 C208.tmp 89 PID 1156 wrote to memory of 216 1156 C208.tmp 89 PID 216 wrote to memory of 344 216 C294.tmp 91 PID 216 wrote to memory of 344 216 C294.tmp 91 PID 216 wrote to memory of 344 216 C294.tmp 91 PID 344 wrote to memory of 4552 344 C350.tmp 92 PID 344 wrote to memory of 4552 344 C350.tmp 92 PID 344 wrote to memory of 4552 344 C350.tmp 92 PID 4552 wrote to memory of 2068 4552 C3EC.tmp 93 PID 4552 wrote to memory of 2068 4552 C3EC.tmp 93 PID 4552 wrote to memory of 2068 4552 C3EC.tmp 93 PID 2068 wrote to memory of 4796 2068 C505.tmp 94 PID 2068 wrote to memory of 4796 2068 C505.tmp 94 PID 2068 wrote to memory of 4796 2068 C505.tmp 94 PID 4796 wrote to memory of 4868 4796 C60F.tmp 96 PID 4796 wrote to memory of 4868 4796 C60F.tmp 96 PID 4796 wrote to memory of 4868 4796 C60F.tmp 96 PID 4868 wrote to memory of 2028 4868 C709.tmp 97 PID 4868 wrote to memory of 2028 4868 C709.tmp 97 PID 4868 wrote to memory of 2028 4868 C709.tmp 97 PID 2028 wrote to memory of 232 2028 C7D4.tmp 98 PID 2028 wrote to memory of 232 2028 C7D4.tmp 98 PID 2028 wrote to memory of 232 2028 C7D4.tmp 98 PID 232 wrote to memory of 1576 232 C89F.tmp 99 PID 232 wrote to memory of 1576 232 C89F.tmp 99 PID 232 wrote to memory of 1576 232 C89F.tmp 99 PID 1576 wrote to memory of 3288 1576 C9B8.tmp 100 PID 1576 wrote to memory of 3288 1576 C9B8.tmp 100 PID 1576 wrote to memory of 3288 1576 C9B8.tmp 100 PID 3288 wrote to memory of 3736 3288 CAA3.tmp 101 PID 3288 wrote to memory of 3736 3288 CAA3.tmp 101 PID 3288 wrote to memory of 3736 3288 CAA3.tmp 101 PID 3736 wrote to memory of 1632 3736 CB5E.tmp 102 PID 3736 wrote to memory of 1632 3736 CB5E.tmp 102 PID 3736 wrote to memory of 1632 3736 CB5E.tmp 102 PID 1632 wrote to memory of 1436 1632 CCB6.tmp 103 PID 1632 wrote to memory of 1436 1632 CCB6.tmp 103 PID 1632 wrote to memory of 1436 1632 CCB6.tmp 103 PID 1436 wrote to memory of 1752 1436 CD43.tmp 104 PID 1436 wrote to memory of 1752 1436 CD43.tmp 104 PID 1436 wrote to memory of 1752 1436 CD43.tmp 104 PID 1752 wrote to memory of 2880 1752 CDEF.tmp 105 PID 1752 wrote to memory of 2880 1752 CDEF.tmp 105 PID 1752 wrote to memory of 2880 1752 CDEF.tmp 105 PID 2880 wrote to memory of 4264 2880 CE7B.tmp 106 PID 2880 wrote to memory of 4264 2880 CE7B.tmp 106 PID 2880 wrote to memory of 4264 2880 CE7B.tmp 106 PID 4264 wrote to memory of 3400 4264 CF17.tmp 107 PID 4264 wrote to memory of 3400 4264 CF17.tmp 107 PID 4264 wrote to memory of 3400 4264 CF17.tmp 107 PID 3400 wrote to memory of 4940 3400 CFA4.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\aa983393e13e1a48c86e17fa3a41cd91_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"23⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"24⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"25⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"26⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"27⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"28⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"29⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"30⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"31⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"32⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"33⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"C:\Users\Admin\AppData\Local\Temp\D7D2.tmp"34⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"35⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"36⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"37⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"38⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\DACF.tmp"C:\Users\Admin\AppData\Local\Temp\DACF.tmp"39⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"40⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"41⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"42⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"43⤵
- Executes dropped EXE
PID:236 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"44⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"45⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"46⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\DF63.tmp"C:\Users\Admin\AppData\Local\Temp\DF63.tmp"47⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"48⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"49⤵
- Executes dropped EXE
PID:576 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"50⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"C:\Users\Admin\AppData\Local\Temp\E1B5.tmp"51⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\E242.tmp"C:\Users\Admin\AppData\Local\Temp\E242.tmp"52⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"53⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"54⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"55⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"56⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"C:\Users\Admin\AppData\Local\Temp\E4E2.tmp"57⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"58⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"59⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"60⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"61⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"62⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"63⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"64⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"65⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"66⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"67⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"68⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"69⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"70⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"71⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"72⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"73⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"74⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"75⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"C:\Users\Admin\AppData\Local\Temp\EFAF.tmp"76⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"77⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"78⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"79⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"80⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"81⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"82⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\F31A.tmp"C:\Users\Admin\AppData\Local\Temp\F31A.tmp"83⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"84⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"85⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"86⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"87⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"88⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"89⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"C:\Users\Admin\AppData\Local\Temp\F6B4.tmp"90⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"91⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"92⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"93⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"94⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"95⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"96⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"97⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"98⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"99⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"100⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"101⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"103⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"104⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"105⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"106⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"107⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"108⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"109⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"110⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"111⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"112⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"113⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"114⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"115⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"116⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"117⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\579.tmp"C:\Users\Admin\AppData\Local\Temp\579.tmp"119⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"120⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"121⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"122⤵PID:4604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-