Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe
-
Size
520KB
-
MD5
86dff6f3d3617ae54be589ad4b136325
-
SHA1
ff86ebae583e0e927d89b456d3c516f155e2930b
-
SHA256
69929b1abcc32fda2e6d70b5d5176c46c9c8ceea988ba72ba5ba857782567579
-
SHA512
6c6ecf019263b482b036e4f84dfb251075d989ff3e1f8f0dfbfd423e268d483e29825535dd5aa22f0759fcabd5e65c5f41ec308fc62993ff9b906b914064f011
-
SSDEEP
12288:roRXOQjmOyriNhfA0EZNeysXPxdP/LYqKkRvNZ:rogQ9yrcs0Bt/N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4092 C4A8.tmp 4396 C563.tmp 3328 C5FF.tmp 3048 C6CA.tmp 940 C7B5.tmp 3044 C851.tmp 1028 C93B.tmp 2656 CA84.tmp 1680 CB01.tmp 2116 CB8D.tmp 3256 CC0A.tmp 4708 CCC6.tmp 3904 CD81.tmp 4920 CE3D.tmp 228 CF08.tmp 3552 CFB4.tmp 4400 D09E.tmp 1300 D12B.tmp 1472 D1C7.tmp 664 D2B1.tmp 2296 D39C.tmp 4928 D448.tmp 2144 D532.tmp 5084 D5AF.tmp 3400 D63C.tmp 4672 D6D8.tmp 1612 D7C2.tmp 4380 D8DB.tmp 1504 D987.tmp 2832 DA24.tmp 2944 DAC0.tmp 4916 DB9B.tmp 960 DCA4.tmp 1516 DD31.tmp 4452 DDBD.tmp 2040 DE5A.tmp 3396 DF44.tmp 4688 DFD1.tmp 1376 E06D.tmp 1636 E109.tmp 4664 E196.tmp 1296 E222.tmp 4740 E29F.tmp 5020 E30D.tmp 2668 E37A.tmp 3884 E407.tmp 2020 E484.tmp 2748 E501.tmp 3800 E59D.tmp 180 E62A.tmp 3832 E6B6.tmp 3480 E753.tmp 2960 E7D0.tmp 3992 E85C.tmp 1868 E8D9.tmp 3720 E975.tmp 3676 E9E3.tmp 3668 EA6F.tmp 4872 EAEC.tmp 4712 EB5A.tmp 4852 EBD7.tmp 4924 EC54.tmp 2116 ECD1.tmp 3748 ED4E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3884 wrote to memory of 4092 3884 2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe 85 PID 3884 wrote to memory of 4092 3884 2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe 85 PID 3884 wrote to memory of 4092 3884 2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe 85 PID 4092 wrote to memory of 4396 4092 C4A8.tmp 86 PID 4092 wrote to memory of 4396 4092 C4A8.tmp 86 PID 4092 wrote to memory of 4396 4092 C4A8.tmp 86 PID 4396 wrote to memory of 3328 4396 C563.tmp 87 PID 4396 wrote to memory of 3328 4396 C563.tmp 87 PID 4396 wrote to memory of 3328 4396 C563.tmp 87 PID 3328 wrote to memory of 3048 3328 C5FF.tmp 88 PID 3328 wrote to memory of 3048 3328 C5FF.tmp 88 PID 3328 wrote to memory of 3048 3328 C5FF.tmp 88 PID 3048 wrote to memory of 940 3048 C6CA.tmp 89 PID 3048 wrote to memory of 940 3048 C6CA.tmp 89 PID 3048 wrote to memory of 940 3048 C6CA.tmp 89 PID 940 wrote to memory of 3044 940 C7B5.tmp 90 PID 940 wrote to memory of 3044 940 C7B5.tmp 90 PID 940 wrote to memory of 3044 940 C7B5.tmp 90 PID 3044 wrote to memory of 1028 3044 C851.tmp 91 PID 3044 wrote to memory of 1028 3044 C851.tmp 91 PID 3044 wrote to memory of 1028 3044 C851.tmp 91 PID 1028 wrote to memory of 2656 1028 C93B.tmp 92 PID 1028 wrote to memory of 2656 1028 C93B.tmp 92 PID 1028 wrote to memory of 2656 1028 C93B.tmp 92 PID 2656 wrote to memory of 1680 2656 CA84.tmp 93 PID 2656 wrote to memory of 1680 2656 CA84.tmp 93 PID 2656 wrote to memory of 1680 2656 CA84.tmp 93 PID 1680 wrote to memory of 2116 1680 CB01.tmp 94 PID 1680 wrote to memory of 2116 1680 CB01.tmp 94 PID 1680 wrote to memory of 2116 1680 CB01.tmp 94 PID 2116 wrote to memory of 3256 2116 CB8D.tmp 95 PID 2116 wrote to memory of 3256 2116 CB8D.tmp 95 PID 2116 wrote to memory of 3256 2116 CB8D.tmp 95 PID 3256 wrote to memory of 4708 3256 CC0A.tmp 96 PID 3256 wrote to memory of 4708 3256 CC0A.tmp 96 PID 3256 wrote to memory of 4708 3256 CC0A.tmp 96 PID 4708 wrote to memory of 3904 4708 CCC6.tmp 97 PID 4708 wrote to memory of 3904 4708 CCC6.tmp 97 PID 4708 wrote to memory of 3904 4708 CCC6.tmp 97 PID 3904 wrote to memory of 4920 3904 CD81.tmp 99 PID 3904 wrote to memory of 4920 3904 CD81.tmp 99 PID 3904 wrote to memory of 4920 3904 CD81.tmp 99 PID 4920 wrote to memory of 228 4920 CE3D.tmp 100 PID 4920 wrote to memory of 228 4920 CE3D.tmp 100 PID 4920 wrote to memory of 228 4920 CE3D.tmp 100 PID 228 wrote to memory of 3552 228 CF08.tmp 101 PID 228 wrote to memory of 3552 228 CF08.tmp 101 PID 228 wrote to memory of 3552 228 CF08.tmp 101 PID 3552 wrote to memory of 4400 3552 CFB4.tmp 103 PID 3552 wrote to memory of 4400 3552 CFB4.tmp 103 PID 3552 wrote to memory of 4400 3552 CFB4.tmp 103 PID 4400 wrote to memory of 1300 4400 D09E.tmp 104 PID 4400 wrote to memory of 1300 4400 D09E.tmp 104 PID 4400 wrote to memory of 1300 4400 D09E.tmp 104 PID 1300 wrote to memory of 1472 1300 D12B.tmp 105 PID 1300 wrote to memory of 1472 1300 D12B.tmp 105 PID 1300 wrote to memory of 1472 1300 D12B.tmp 105 PID 1472 wrote to memory of 664 1472 D1C7.tmp 106 PID 1472 wrote to memory of 664 1472 D1C7.tmp 106 PID 1472 wrote to memory of 664 1472 D1C7.tmp 106 PID 664 wrote to memory of 2296 664 D2B1.tmp 107 PID 664 wrote to memory of 2296 664 D2B1.tmp 107 PID 664 wrote to memory of 2296 664 D2B1.tmp 107 PID 2296 wrote to memory of 4928 2296 D39C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_86dff6f3d3617ae54be589ad4b136325_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"C:\Users\Admin\AppData\Local\Temp\D2B1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"23⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"24⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"25⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"26⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"27⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"28⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"29⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"30⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"31⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"32⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"33⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"34⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\DD31.tmp"C:\Users\Admin\AppData\Local\Temp\DD31.tmp"35⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"36⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"37⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\DF44.tmp"C:\Users\Admin\AppData\Local\Temp\DF44.tmp"38⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"39⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"40⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"41⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"42⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"43⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\E29F.tmp"C:\Users\Admin\AppData\Local\Temp\E29F.tmp"44⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"45⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"46⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"47⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"48⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"49⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"50⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"51⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"52⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"53⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"54⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"55⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"56⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"57⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"58⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"59⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"60⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"61⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"62⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"63⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"64⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"65⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"C:\Users\Admin\AppData\Local\Temp\EDCB.tmp"66⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"67⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"68⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"69⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"70⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"71⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"72⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"73⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"74⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"75⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"76⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"77⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"78⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"79⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"80⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"81⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"82⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"83⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"84⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\F83B.tmp"C:\Users\Admin\AppData\Local\Temp\F83B.tmp"85⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"86⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F954.tmp"C:\Users\Admin\AppData\Local\Temp\F954.tmp"87⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"88⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"89⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"90⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"91⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"92⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\FC90.tmp"C:\Users\Admin\AppData\Local\Temp\FC90.tmp"93⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"94⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"95⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"96⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\FE84.tmp"C:\Users\Admin\AppData\Local\Temp\FE84.tmp"97⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"98⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"99⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"100⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"101⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"102⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"103⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\26C.tmp"C:\Users\Admin\AppData\Local\Temp\26C.tmp"104⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"105⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"106⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"107⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"108⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"109⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"110⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"111⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"112⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"113⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"114⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\896.tmp"C:\Users\Admin\AppData\Local\Temp\896.tmp"115⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"116⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"117⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"118⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"119⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"120⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"121⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-