Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe
-
Size
486KB
-
MD5
07c063fe199b2483764165f8d307a7cd
-
SHA1
e4989237db0285a9821ee55a2aafd696f6e77831
-
SHA256
12e3dfde9a66073d623d9819ac45da81e5ba765bc3ee0e36bba0a668381436c3
-
SHA512
6deebc1f5b8de7680294640db3d1dd9219833c5ebe44316ebc3944057ce49d84b4b8f5081ddee78b004fd8971ac467c1fdcf6143edf238965bb113ec98942553
-
SSDEEP
12288:UU5rCOTeiDFt5jBElAcS2lxPlKnG/HQNZ:UUQOJDbxyzL3PlGCQN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 636 C265.tmp 4088 C2F2.tmp 4028 C37F.tmp 2728 C459.tmp 2232 C544.tmp 548 C63E.tmp 1460 C719.tmp 980 C7B5.tmp 4992 C851.tmp 3680 C8BE.tmp 3708 C96A.tmp 3596 CA26.tmp 4680 CB01.tmp 4932 CBBC.tmp 3436 CC87.tmp 3444 CD14.tmp 1488 CDEF.tmp 1844 CEAA.tmp 2784 CFA4.tmp 4956 D050.tmp 5100 D14A.tmp 4000 D215.tmp 1404 D30F.tmp 564 D3AB.tmp 3320 D467.tmp 3344 D503.tmp 1496 D5DE.tmp 1620 D66A.tmp 2820 D716.tmp 4832 D7B3.tmp 4912 D89D.tmp 3544 D939.tmp 3984 DA04.tmp 4212 DA91.tmp 1744 DB1E.tmp 1696 DBD9.tmp 700 DC75.tmp 1492 DCF2.tmp 1464 DD60.tmp 1216 DDCD.tmp 4968 DE5A.tmp 4124 DED7.tmp 4240 DF54.tmp 5104 DFD1.tmp 2712 E06D.tmp 828 E109.tmp 2024 E196.tmp 3932 E222.tmp 5068 E2AF.tmp 1584 E32C.tmp 2356 E3B9.tmp 5016 E426.tmp 3588 E4B3.tmp 4916 E54F.tmp 1252 E5EB.tmp 2956 E687.tmp 2940 E714.tmp 4340 E7A1.tmp 212 E81E.tmp 2120 E8BA.tmp 1564 E947.tmp 1076 E9D3.tmp 2596 EA6F.tmp 2608 EAEC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 636 2804 2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe 83 PID 2804 wrote to memory of 636 2804 2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe 83 PID 2804 wrote to memory of 636 2804 2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe 83 PID 636 wrote to memory of 4088 636 C265.tmp 85 PID 636 wrote to memory of 4088 636 C265.tmp 85 PID 636 wrote to memory of 4088 636 C265.tmp 85 PID 4088 wrote to memory of 4028 4088 C2F2.tmp 86 PID 4088 wrote to memory of 4028 4088 C2F2.tmp 86 PID 4088 wrote to memory of 4028 4088 C2F2.tmp 86 PID 4028 wrote to memory of 2728 4028 C37F.tmp 87 PID 4028 wrote to memory of 2728 4028 C37F.tmp 87 PID 4028 wrote to memory of 2728 4028 C37F.tmp 87 PID 2728 wrote to memory of 2232 2728 C459.tmp 88 PID 2728 wrote to memory of 2232 2728 C459.tmp 88 PID 2728 wrote to memory of 2232 2728 C459.tmp 88 PID 2232 wrote to memory of 548 2232 C544.tmp 89 PID 2232 wrote to memory of 548 2232 C544.tmp 89 PID 2232 wrote to memory of 548 2232 C544.tmp 89 PID 548 wrote to memory of 1460 548 C63E.tmp 90 PID 548 wrote to memory of 1460 548 C63E.tmp 90 PID 548 wrote to memory of 1460 548 C63E.tmp 90 PID 1460 wrote to memory of 980 1460 C719.tmp 91 PID 1460 wrote to memory of 980 1460 C719.tmp 91 PID 1460 wrote to memory of 980 1460 C719.tmp 91 PID 980 wrote to memory of 4992 980 C7B5.tmp 92 PID 980 wrote to memory of 4992 980 C7B5.tmp 92 PID 980 wrote to memory of 4992 980 C7B5.tmp 92 PID 4992 wrote to memory of 3680 4992 C851.tmp 93 PID 4992 wrote to memory of 3680 4992 C851.tmp 93 PID 4992 wrote to memory of 3680 4992 C851.tmp 93 PID 3680 wrote to memory of 3708 3680 C8BE.tmp 94 PID 3680 wrote to memory of 3708 3680 C8BE.tmp 94 PID 3680 wrote to memory of 3708 3680 C8BE.tmp 94 PID 3708 wrote to memory of 3596 3708 C96A.tmp 95 PID 3708 wrote to memory of 3596 3708 C96A.tmp 95 PID 3708 wrote to memory of 3596 3708 C96A.tmp 95 PID 3596 wrote to memory of 4680 3596 CA26.tmp 96 PID 3596 wrote to memory of 4680 3596 CA26.tmp 96 PID 3596 wrote to memory of 4680 3596 CA26.tmp 96 PID 4680 wrote to memory of 4932 4680 CB01.tmp 97 PID 4680 wrote to memory of 4932 4680 CB01.tmp 97 PID 4680 wrote to memory of 4932 4680 CB01.tmp 97 PID 4932 wrote to memory of 3436 4932 CBBC.tmp 98 PID 4932 wrote to memory of 3436 4932 CBBC.tmp 98 PID 4932 wrote to memory of 3436 4932 CBBC.tmp 98 PID 3436 wrote to memory of 3444 3436 CC87.tmp 99 PID 3436 wrote to memory of 3444 3436 CC87.tmp 99 PID 3436 wrote to memory of 3444 3436 CC87.tmp 99 PID 3444 wrote to memory of 1488 3444 CD14.tmp 100 PID 3444 wrote to memory of 1488 3444 CD14.tmp 100 PID 3444 wrote to memory of 1488 3444 CD14.tmp 100 PID 1488 wrote to memory of 1844 1488 CDEF.tmp 101 PID 1488 wrote to memory of 1844 1488 CDEF.tmp 101 PID 1488 wrote to memory of 1844 1488 CDEF.tmp 101 PID 1844 wrote to memory of 2784 1844 CEAA.tmp 102 PID 1844 wrote to memory of 2784 1844 CEAA.tmp 102 PID 1844 wrote to memory of 2784 1844 CEAA.tmp 102 PID 2784 wrote to memory of 4956 2784 CFA4.tmp 103 PID 2784 wrote to memory of 4956 2784 CFA4.tmp 103 PID 2784 wrote to memory of 4956 2784 CFA4.tmp 103 PID 4956 wrote to memory of 5100 4956 D050.tmp 104 PID 4956 wrote to memory of 5100 4956 D050.tmp 104 PID 4956 wrote to memory of 5100 4956 D050.tmp 104 PID 5100 wrote to memory of 4000 5100 D14A.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_07c063fe199b2483764165f8d307a7cd_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\D14A.tmp"C:\Users\Admin\AppData\Local\Temp\D14A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"23⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"24⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"25⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"26⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"27⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"28⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"29⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"30⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"31⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"32⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"33⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"34⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"35⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"36⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"37⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"38⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"39⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"40⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"41⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"42⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"43⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"44⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"C:\Users\Admin\AppData\Local\Temp\DFD1.tmp"45⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"46⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\E109.tmp"C:\Users\Admin\AppData\Local\Temp\E109.tmp"47⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"48⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"49⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"50⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"51⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"52⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"53⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"C:\Users\Admin\AppData\Local\Temp\E4B3.tmp"54⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"55⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"56⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"57⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"58⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"59⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"60⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"61⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"62⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"C:\Users\Admin\AppData\Local\Temp\E9D3.tmp"63⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"64⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\EB69.tmp"C:\Users\Admin\AppData\Local\Temp\EB69.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"C:\Users\Admin\AppData\Local\Temp\EBF6.tmp"67⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"68⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"69⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"71⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"72⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"73⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"74⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"75⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"76⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"77⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\F184.tmp"C:\Users\Admin\AppData\Local\Temp\F184.tmp"78⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"79⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"80⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"81⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"82⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"83⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"84⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\F51E.tmp"C:\Users\Admin\AppData\Local\Temp\F51E.tmp"85⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"86⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"87⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"88⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\F731.tmp"C:\Users\Admin\AppData\Local\Temp\F731.tmp"89⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"C:\Users\Admin\AppData\Local\Temp\F7CD.tmp"90⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"92⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"C:\Users\Admin\AppData\Local\Temp\F9A2.tmp"93⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"94⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"95⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"96⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"97⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"98⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"99⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"100⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"101⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"102⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"103⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"104⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"105⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"C:\Users\Admin\AppData\Local\Temp\FFEB.tmp"106⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"107⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"108⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"109⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"110⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"111⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"112⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"113⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"114⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"115⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"116⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\5E7.tmp"C:\Users\Admin\AppData\Local\Temp\5E7.tmp"117⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\664.tmp"C:\Users\Admin\AppData\Local\Temp\664.tmp"118⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"119⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"120⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"121⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-