Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe
-
Size
486KB
-
MD5
fb8c8eba0cbafa4c03044e5c18f67b25
-
SHA1
36270e85c6cfe4d8bf634a04c7f5acd2f8be7b2d
-
SHA256
c422883b081af25e190a029c6ef66fa32182e35340ce8b07c4a10b52ba0befd4
-
SHA512
6133ef2074bd5f2a7da92f66d5ae3dfa7af0e8525b18360391cad1e1025d8466c7e3d83eb2be5e948b5e69964d2c13d1f01cf2cc69ce7383c8de47805f95a53b
-
SSDEEP
12288:/U5rCOTeiDgrIk0RN+ny1wtalmwuZuqpf11B1hNZ:/UQOJDGIkeN+ny1Aa4ZuSf11NN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3336 D244.tmp 1508 D32E.tmp 4332 D3EA.tmp 1800 D4B5.tmp 3108 D570.tmp 3664 D62C.tmp 3320 D6E7.tmp 3692 D784.tmp 652 D830.tmp 1988 D8CC.tmp 3964 D978.tmp 4208 DA43.tmp 4772 DB0E.tmp 4880 DBD9.tmp 804 DC66.tmp 1444 DD02.tmp 2400 DE79.tmp 1884 DF15.tmp 1020 DFF0.tmp 2904 E07D.tmp 5104 E416.tmp 2128 E4C2.tmp 3632 E56E.tmp 1652 E60A.tmp 2728 E6B6.tmp 4860 E733.tmp 2960 E7C0.tmp 2024 E82D.tmp 3784 E8AA.tmp 2420 E956.tmp 1608 EA21.tmp 4884 EAEC.tmp 4812 EBB8.tmp 2528 EC54.tmp 1164 ECF0.tmp 4500 ED7D.tmp 4652 EE19.tmp 3456 EEC5.tmp 2284 EF61.tmp 64 EFFD.tmp 3196 F08A.tmp 1836 F126.tmp 3252 F1A3.tmp 2888 F23F.tmp 2152 F2EB.tmp 208 F405.tmp 3936 F4A1.tmp 3916 F52D.tmp 2828 F5D9.tmp 4724 F656.tmp 1908 F6E3.tmp 1996 F760.tmp 4856 F7ED.tmp 4644 F85A.tmp 1536 F906.tmp 3836 F992.tmp 2756 FA1F.tmp 2636 FAAC.tmp 1508 FB38.tmp 4388 FBD5.tmp 4068 FC61.tmp 2312 FCDE.tmp 4396 FD4C.tmp 760 FDC9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3336 4900 fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe 81 PID 4900 wrote to memory of 3336 4900 fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe 81 PID 4900 wrote to memory of 3336 4900 fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe 81 PID 3336 wrote to memory of 1508 3336 D244.tmp 82 PID 3336 wrote to memory of 1508 3336 D244.tmp 82 PID 3336 wrote to memory of 1508 3336 D244.tmp 82 PID 1508 wrote to memory of 4332 1508 D32E.tmp 83 PID 1508 wrote to memory of 4332 1508 D32E.tmp 83 PID 1508 wrote to memory of 4332 1508 D32E.tmp 83 PID 4332 wrote to memory of 1800 4332 D3EA.tmp 84 PID 4332 wrote to memory of 1800 4332 D3EA.tmp 84 PID 4332 wrote to memory of 1800 4332 D3EA.tmp 84 PID 1800 wrote to memory of 3108 1800 D4B5.tmp 85 PID 1800 wrote to memory of 3108 1800 D4B5.tmp 85 PID 1800 wrote to memory of 3108 1800 D4B5.tmp 85 PID 3108 wrote to memory of 3664 3108 D570.tmp 86 PID 3108 wrote to memory of 3664 3108 D570.tmp 86 PID 3108 wrote to memory of 3664 3108 D570.tmp 86 PID 3664 wrote to memory of 3320 3664 D62C.tmp 87 PID 3664 wrote to memory of 3320 3664 D62C.tmp 87 PID 3664 wrote to memory of 3320 3664 D62C.tmp 87 PID 3320 wrote to memory of 3692 3320 D6E7.tmp 88 PID 3320 wrote to memory of 3692 3320 D6E7.tmp 88 PID 3320 wrote to memory of 3692 3320 D6E7.tmp 88 PID 3692 wrote to memory of 652 3692 D784.tmp 89 PID 3692 wrote to memory of 652 3692 D784.tmp 89 PID 3692 wrote to memory of 652 3692 D784.tmp 89 PID 652 wrote to memory of 1988 652 D830.tmp 90 PID 652 wrote to memory of 1988 652 D830.tmp 90 PID 652 wrote to memory of 1988 652 D830.tmp 90 PID 1988 wrote to memory of 3964 1988 D8CC.tmp 91 PID 1988 wrote to memory of 3964 1988 D8CC.tmp 91 PID 1988 wrote to memory of 3964 1988 D8CC.tmp 91 PID 3964 wrote to memory of 4208 3964 D978.tmp 92 PID 3964 wrote to memory of 4208 3964 D978.tmp 92 PID 3964 wrote to memory of 4208 3964 D978.tmp 92 PID 4208 wrote to memory of 4772 4208 DA43.tmp 93 PID 4208 wrote to memory of 4772 4208 DA43.tmp 93 PID 4208 wrote to memory of 4772 4208 DA43.tmp 93 PID 4772 wrote to memory of 4880 4772 DB0E.tmp 94 PID 4772 wrote to memory of 4880 4772 DB0E.tmp 94 PID 4772 wrote to memory of 4880 4772 DB0E.tmp 94 PID 4880 wrote to memory of 804 4880 DBD9.tmp 95 PID 4880 wrote to memory of 804 4880 DBD9.tmp 95 PID 4880 wrote to memory of 804 4880 DBD9.tmp 95 PID 804 wrote to memory of 1444 804 DC66.tmp 96 PID 804 wrote to memory of 1444 804 DC66.tmp 96 PID 804 wrote to memory of 1444 804 DC66.tmp 96 PID 1444 wrote to memory of 2400 1444 DD02.tmp 97 PID 1444 wrote to memory of 2400 1444 DD02.tmp 97 PID 1444 wrote to memory of 2400 1444 DD02.tmp 97 PID 2400 wrote to memory of 1884 2400 DE79.tmp 98 PID 2400 wrote to memory of 1884 2400 DE79.tmp 98 PID 2400 wrote to memory of 1884 2400 DE79.tmp 98 PID 1884 wrote to memory of 1020 1884 DF15.tmp 99 PID 1884 wrote to memory of 1020 1884 DF15.tmp 99 PID 1884 wrote to memory of 1020 1884 DF15.tmp 99 PID 1020 wrote to memory of 2904 1020 DFF0.tmp 102 PID 1020 wrote to memory of 2904 1020 DFF0.tmp 102 PID 1020 wrote to memory of 2904 1020 DFF0.tmp 102 PID 2904 wrote to memory of 5104 2904 E07D.tmp 103 PID 2904 wrote to memory of 5104 2904 E07D.tmp 103 PID 2904 wrote to memory of 5104 2904 E07D.tmp 103 PID 5104 wrote to memory of 2128 5104 E416.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fb8c8eba0cbafa4c03044e5c18f67b25_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\D244.tmp"C:\Users\Admin\AppData\Local\Temp\D244.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"C:\Users\Admin\AppData\Local\Temp\D4B5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\DA43.tmp"C:\Users\Admin\AppData\Local\Temp\DA43.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\DC66.tmp"C:\Users\Admin\AppData\Local\Temp\DC66.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\E416.tmp"C:\Users\Admin\AppData\Local\Temp\E416.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"23⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"24⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"25⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"26⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"27⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"28⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"29⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"30⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"31⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"32⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"33⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"34⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"35⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"36⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"37⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"38⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"39⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"40⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"41⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"42⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"43⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"44⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"45⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"46⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"47⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"48⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"49⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"50⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"51⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"52⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"53⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"54⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"55⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"56⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"57⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"58⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"59⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"60⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"61⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"62⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"63⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"64⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"65⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"66⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"67⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"68⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"69⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"70⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"71⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"72⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"73⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"74⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"75⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"76⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"77⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"78⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"79⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"80⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"81⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\78D.tmp"C:\Users\Admin\AppData\Local\Temp\78D.tmp"82⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"83⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"84⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"85⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"86⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"87⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"88⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"89⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"90⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"91⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"92⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"93⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"94⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"95⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"96⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"97⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"98⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"99⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"100⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"101⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"102⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"103⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"104⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"105⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"106⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"107⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"108⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"109⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"110⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"111⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\1846.tmp"C:\Users\Admin\AppData\Local\Temp\1846.tmp"112⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"113⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"114⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"115⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"116⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"117⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"118⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"119⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"120⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"121⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"122⤵PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-