Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe
-
Size
487KB
-
MD5
c8406d6bec018cd97142f6cd3e7bbda3
-
SHA1
5e7677d537ab45f8fbf6a319208b19f902a828f6
-
SHA256
06332ea39110ce705b9d8138a4f1b0938f8333c04b1e103968a718ed5c516a3a
-
SHA512
855a51a48f32d4ebede2fc7455038406be0f61ce1f380bd5e51296a340b3308f7bce078969ead2502c52f6029574888e5ef72ead9fde4320a571020f7085eb13
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUZJVnqMj2nXVhbZmV7hBhRzBwzCfd6ms49Ei:HU5rCOTeiJCRj2nAxBwa6mslpK+zZNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3728 DEA8.tmp 3732 DF73.tmp 1448 E01F.tmp 3564 E0BB.tmp 2576 E177.tmp 3968 E203.tmp 2908 E290.tmp 4896 E31C.tmp 3444 E3C8.tmp 2916 E4A3.tmp 1476 E510.tmp 1060 E5CC.tmp 4808 E659.tmp 3596 E714.tmp 4720 E7A1.tmp 2684 E82D.tmp 1444 E966.tmp 4168 E9F2.tmp 3512 EAAE.tmp 4984 EB5A.tmp 1340 EC06.tmp 5116 ECE0.tmp 3508 EDCB.tmp 2172 EE86.tmp 2424 EF61.tmp 728 EFFD.tmp 4144 F08A.tmp 3772 F126.tmp 2648 F1C2.tmp 984 F26E.tmp 1380 F368.tmp 952 F443.tmp 1020 F4DF.tmp 416 F54D.tmp 4116 F5D9.tmp 3920 F676.tmp 3020 F702.tmp 4324 F78F.tmp 2272 F82B.tmp 3408 F8B8.tmp 1420 F9B2.tmp 4136 FA3E.tmp 632 FABB.tmp 3472 FB38.tmp 2712 FBC5.tmp 2120 FC42.tmp 4940 FCBF.tmp 4296 FD4C.tmp 4580 FDF7.tmp 3604 FEA3.tmp 528 FF40.tmp 2988 FFEB.tmp 1316 88.tmp 4860 114.tmp 872 1B1.tmp 2580 28B.tmp 1012 337.tmp 4568 3A5.tmp 1032 431.tmp 3416 4AE.tmp 2568 55A.tmp 1452 5F6.tmp 2740 664.tmp 372 6E1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3728 2484 c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe 80 PID 2484 wrote to memory of 3728 2484 c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe 80 PID 2484 wrote to memory of 3728 2484 c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe 80 PID 3728 wrote to memory of 3732 3728 DEA8.tmp 81 PID 3728 wrote to memory of 3732 3728 DEA8.tmp 81 PID 3728 wrote to memory of 3732 3728 DEA8.tmp 81 PID 3732 wrote to memory of 1448 3732 DF73.tmp 82 PID 3732 wrote to memory of 1448 3732 DF73.tmp 82 PID 3732 wrote to memory of 1448 3732 DF73.tmp 82 PID 1448 wrote to memory of 3564 1448 E01F.tmp 83 PID 1448 wrote to memory of 3564 1448 E01F.tmp 83 PID 1448 wrote to memory of 3564 1448 E01F.tmp 83 PID 3564 wrote to memory of 2576 3564 E0BB.tmp 84 PID 3564 wrote to memory of 2576 3564 E0BB.tmp 84 PID 3564 wrote to memory of 2576 3564 E0BB.tmp 84 PID 2576 wrote to memory of 3968 2576 E177.tmp 85 PID 2576 wrote to memory of 3968 2576 E177.tmp 85 PID 2576 wrote to memory of 3968 2576 E177.tmp 85 PID 3968 wrote to memory of 2908 3968 E203.tmp 86 PID 3968 wrote to memory of 2908 3968 E203.tmp 86 PID 3968 wrote to memory of 2908 3968 E203.tmp 86 PID 2908 wrote to memory of 4896 2908 E290.tmp 87 PID 2908 wrote to memory of 4896 2908 E290.tmp 87 PID 2908 wrote to memory of 4896 2908 E290.tmp 87 PID 4896 wrote to memory of 3444 4896 E31C.tmp 88 PID 4896 wrote to memory of 3444 4896 E31C.tmp 88 PID 4896 wrote to memory of 3444 4896 E31C.tmp 88 PID 3444 wrote to memory of 2916 3444 E3C8.tmp 89 PID 3444 wrote to memory of 2916 3444 E3C8.tmp 89 PID 3444 wrote to memory of 2916 3444 E3C8.tmp 89 PID 2916 wrote to memory of 1476 2916 E4A3.tmp 90 PID 2916 wrote to memory of 1476 2916 E4A3.tmp 90 PID 2916 wrote to memory of 1476 2916 E4A3.tmp 90 PID 1476 wrote to memory of 1060 1476 E510.tmp 92 PID 1476 wrote to memory of 1060 1476 E510.tmp 92 PID 1476 wrote to memory of 1060 1476 E510.tmp 92 PID 1060 wrote to memory of 4808 1060 E5CC.tmp 93 PID 1060 wrote to memory of 4808 1060 E5CC.tmp 93 PID 1060 wrote to memory of 4808 1060 E5CC.tmp 93 PID 4808 wrote to memory of 3596 4808 E659.tmp 94 PID 4808 wrote to memory of 3596 4808 E659.tmp 94 PID 4808 wrote to memory of 3596 4808 E659.tmp 94 PID 3596 wrote to memory of 4720 3596 E714.tmp 95 PID 3596 wrote to memory of 4720 3596 E714.tmp 95 PID 3596 wrote to memory of 4720 3596 E714.tmp 95 PID 4720 wrote to memory of 2684 4720 E7A1.tmp 96 PID 4720 wrote to memory of 2684 4720 E7A1.tmp 96 PID 4720 wrote to memory of 2684 4720 E7A1.tmp 96 PID 2684 wrote to memory of 1444 2684 E82D.tmp 97 PID 2684 wrote to memory of 1444 2684 E82D.tmp 97 PID 2684 wrote to memory of 1444 2684 E82D.tmp 97 PID 1444 wrote to memory of 4168 1444 E966.tmp 98 PID 1444 wrote to memory of 4168 1444 E966.tmp 98 PID 1444 wrote to memory of 4168 1444 E966.tmp 98 PID 4168 wrote to memory of 3512 4168 E9F2.tmp 99 PID 4168 wrote to memory of 3512 4168 E9F2.tmp 99 PID 4168 wrote to memory of 3512 4168 E9F2.tmp 99 PID 3512 wrote to memory of 4984 3512 EAAE.tmp 102 PID 3512 wrote to memory of 4984 3512 EAAE.tmp 102 PID 3512 wrote to memory of 4984 3512 EAAE.tmp 102 PID 4984 wrote to memory of 1340 4984 EB5A.tmp 103 PID 4984 wrote to memory of 1340 4984 EB5A.tmp 103 PID 4984 wrote to memory of 1340 4984 EB5A.tmp 103 PID 1340 wrote to memory of 5116 1340 EC06.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\c8406d6bec018cd97142f6cd3e7bbda3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"C:\Users\Admin\AppData\Local\Temp\E4A3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"C:\Users\Admin\AppData\Local\Temp\E5CC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"23⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"24⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"25⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"26⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"27⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"28⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"29⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"30⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\F26E.tmp"C:\Users\Admin\AppData\Local\Temp\F26E.tmp"31⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\F368.tmp"C:\Users\Admin\AppData\Local\Temp\F368.tmp"32⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"33⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"34⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"35⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"36⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"37⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"38⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\F78F.tmp"C:\Users\Admin\AppData\Local\Temp\F78F.tmp"39⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"40⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"C:\Users\Admin\AppData\Local\Temp\F8B8.tmp"41⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"42⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"C:\Users\Admin\AppData\Local\Temp\FA3E.tmp"43⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"44⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"45⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"46⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"47⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"48⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"49⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"50⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"51⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"52⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"53⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\88.tmp"C:\Users\Admin\AppData\Local\Temp\88.tmp"54⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"55⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1B1.tmp"C:\Users\Admin\AppData\Local\Temp\1B1.tmp"56⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"57⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"58⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"59⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"60⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\431.tmp"C:\Users\Admin\AppData\Local\Temp\431.tmp"61⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"62⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"63⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"64⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"65⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6E1.tmp"C:\Users\Admin\AppData\Local\Temp\6E1.tmp"66⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"67⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"68⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"69⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"70⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"71⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"72⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9FE.tmp"C:\Users\Admin\AppData\Local\Temp\9FE.tmp"73⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"74⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"75⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"76⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"77⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"78⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"79⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"80⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"81⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"82⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"83⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\F5D.tmp"C:\Users\Admin\AppData\Local\Temp\F5D.tmp"84⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"85⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"86⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"87⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"88⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"89⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"90⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"91⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\1364.tmp"C:\Users\Admin\AppData\Local\Temp\1364.tmp"92⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"93⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"94⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"95⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"96⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"97⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"98⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"99⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"100⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"101⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"102⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"103⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"104⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"105⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"106⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"107⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"108⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"109⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"110⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"111⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"112⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"113⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"114⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"115⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"116⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"117⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"118⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"119⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"120⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"121⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-