Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe
-
Size
486KB
-
MD5
63c94ffee1e1760f78eac31e1d38f193
-
SHA1
1dd23ea088ee700aa457780e9f0aecb78811ab26
-
SHA256
e7fe348a0b82a7d647439f5be93b329a44f75466d6a8c6c8a90ba1a89722870f
-
SHA512
6580e2b35b8ec32a683cfc8fdad355ec9b7173d32d04082376bb3de3e09117d35d493ee71daff64e0ded102af2e91bb3c74c6ecc41262eb39082abe8c2e90bd6
-
SSDEEP
12288:UU5rCOTeiDM9zWzo0/j3pVVHx0Jp+LNZ:UUQOJDtxL31HO3+LN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3580 C5C1.tmp 2344 C65D.tmp 756 C6F9.tmp 4108 C813.tmp 1144 C8FD.tmp 1628 C999.tmp 1548 CA55.tmp 4724 CB2F.tmp 4392 CBFB.tmp 848 CCB6.tmp 3656 CD91.tmp 1084 CE3D.tmp 1904 CED9.tmp 3716 CFC3.tmp 4692 D060.tmp 5116 D12B.tmp 2652 D2F0.tmp 4968 D3BB.tmp 3232 D448.tmp 500 D532.tmp 3212 D5DE.tmp 3640 D68A.tmp 1612 D784.tmp 2152 D830.tmp 4632 D8DB.tmp 4076 D9B6.tmp 2160 DA72.tmp 3568 DB5C.tmp 2524 DC18.tmp 4144 DCF2.tmp 1068 DDCD.tmp 996 DEB7.tmp 1088 DFB1.tmp 2924 E04E.tmp 776 E0FA.tmp 1472 E1C5.tmp 1948 E261.tmp 4504 E2FD.tmp 3180 E3B9.tmp 3740 E445.tmp 2068 E501.tmp 4836 E5AD.tmp 4920 E649.tmp 3140 E6D6.tmp 3672 E753.tmp 4700 E7D0.tmp 3780 E87B.tmp 4316 E908.tmp 4220 E9B4.tmp 1124 EA41.tmp 3688 EAFC.tmp 3204 EB98.tmp 3372 EC44.tmp 2496 ED00.tmp 4284 ED9C.tmp 4976 EE57.tmp 32 EF03.tmp 2656 EF80.tmp 3696 F02C.tmp 1348 F0E8.tmp 3340 F1A3.tmp 3580 F211.tmp 1344 F2DC.tmp 704 F378.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 3580 2684 2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe 83 PID 2684 wrote to memory of 3580 2684 2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe 83 PID 2684 wrote to memory of 3580 2684 2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe 83 PID 3580 wrote to memory of 2344 3580 C5C1.tmp 84 PID 3580 wrote to memory of 2344 3580 C5C1.tmp 84 PID 3580 wrote to memory of 2344 3580 C5C1.tmp 84 PID 2344 wrote to memory of 756 2344 C65D.tmp 85 PID 2344 wrote to memory of 756 2344 C65D.tmp 85 PID 2344 wrote to memory of 756 2344 C65D.tmp 85 PID 756 wrote to memory of 4108 756 C6F9.tmp 86 PID 756 wrote to memory of 4108 756 C6F9.tmp 86 PID 756 wrote to memory of 4108 756 C6F9.tmp 86 PID 4108 wrote to memory of 1144 4108 C813.tmp 87 PID 4108 wrote to memory of 1144 4108 C813.tmp 87 PID 4108 wrote to memory of 1144 4108 C813.tmp 87 PID 1144 wrote to memory of 1628 1144 C8FD.tmp 88 PID 1144 wrote to memory of 1628 1144 C8FD.tmp 88 PID 1144 wrote to memory of 1628 1144 C8FD.tmp 88 PID 1628 wrote to memory of 1548 1628 C999.tmp 89 PID 1628 wrote to memory of 1548 1628 C999.tmp 89 PID 1628 wrote to memory of 1548 1628 C999.tmp 89 PID 1548 wrote to memory of 4724 1548 CA55.tmp 90 PID 1548 wrote to memory of 4724 1548 CA55.tmp 90 PID 1548 wrote to memory of 4724 1548 CA55.tmp 90 PID 4724 wrote to memory of 4392 4724 CB2F.tmp 91 PID 4724 wrote to memory of 4392 4724 CB2F.tmp 91 PID 4724 wrote to memory of 4392 4724 CB2F.tmp 91 PID 4392 wrote to memory of 848 4392 CBFB.tmp 92 PID 4392 wrote to memory of 848 4392 CBFB.tmp 92 PID 4392 wrote to memory of 848 4392 CBFB.tmp 92 PID 848 wrote to memory of 3656 848 CCB6.tmp 93 PID 848 wrote to memory of 3656 848 CCB6.tmp 93 PID 848 wrote to memory of 3656 848 CCB6.tmp 93 PID 3656 wrote to memory of 1084 3656 CD91.tmp 94 PID 3656 wrote to memory of 1084 3656 CD91.tmp 94 PID 3656 wrote to memory of 1084 3656 CD91.tmp 94 PID 1084 wrote to memory of 1904 1084 CE3D.tmp 95 PID 1084 wrote to memory of 1904 1084 CE3D.tmp 95 PID 1084 wrote to memory of 1904 1084 CE3D.tmp 95 PID 1904 wrote to memory of 3716 1904 CED9.tmp 96 PID 1904 wrote to memory of 3716 1904 CED9.tmp 96 PID 1904 wrote to memory of 3716 1904 CED9.tmp 96 PID 3716 wrote to memory of 4692 3716 CFC3.tmp 97 PID 3716 wrote to memory of 4692 3716 CFC3.tmp 97 PID 3716 wrote to memory of 4692 3716 CFC3.tmp 97 PID 4692 wrote to memory of 5116 4692 D060.tmp 98 PID 4692 wrote to memory of 5116 4692 D060.tmp 98 PID 4692 wrote to memory of 5116 4692 D060.tmp 98 PID 5116 wrote to memory of 2652 5116 D12B.tmp 99 PID 5116 wrote to memory of 2652 5116 D12B.tmp 99 PID 5116 wrote to memory of 2652 5116 D12B.tmp 99 PID 2652 wrote to memory of 4968 2652 D2F0.tmp 100 PID 2652 wrote to memory of 4968 2652 D2F0.tmp 100 PID 2652 wrote to memory of 4968 2652 D2F0.tmp 100 PID 4968 wrote to memory of 3232 4968 D3BB.tmp 101 PID 4968 wrote to memory of 3232 4968 D3BB.tmp 101 PID 4968 wrote to memory of 3232 4968 D3BB.tmp 101 PID 3232 wrote to memory of 500 3232 D448.tmp 102 PID 3232 wrote to memory of 500 3232 D448.tmp 102 PID 3232 wrote to memory of 500 3232 D448.tmp 102 PID 500 wrote to memory of 3212 500 D532.tmp 103 PID 500 wrote to memory of 3212 500 D532.tmp 103 PID 500 wrote to memory of 3212 500 D532.tmp 103 PID 3212 wrote to memory of 3640 3212 D5DE.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_63c94ffee1e1760f78eac31e1d38f193_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\C999.tmp"C:\Users\Admin\AppData\Local\Temp\C999.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"23⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"24⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"25⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"26⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"27⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"28⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"29⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"30⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"31⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"32⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"33⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"34⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"35⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"36⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"37⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"38⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"39⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"40⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\E445.tmp"C:\Users\Admin\AppData\Local\Temp\E445.tmp"41⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"42⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"43⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"44⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"45⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"46⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"47⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"48⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"49⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"50⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"51⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"C:\Users\Admin\AppData\Local\Temp\EAFC.tmp"52⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"53⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"54⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\ED00.tmp"C:\Users\Admin\AppData\Local\Temp\ED00.tmp"55⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"56⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"57⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"58⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"59⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"60⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"C:\Users\Admin\AppData\Local\Temp\F0E8.tmp"61⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"62⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"63⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"64⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\F378.tmp"C:\Users\Admin\AppData\Local\Temp\F378.tmp"65⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"66⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"67⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"68⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"69⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"70⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"71⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\F82B.tmp"C:\Users\Admin\AppData\Local\Temp\F82B.tmp"72⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"C:\Users\Admin\AppData\Local\Temp\F8D7.tmp"73⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"74⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"75⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"76⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\FB86.tmp"C:\Users\Admin\AppData\Local\Temp\FB86.tmp"77⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"78⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"79⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"80⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"C:\Users\Admin\AppData\Local\Temp\FDF7.tmp"81⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"82⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\FF30.tmp"C:\Users\Admin\AppData\Local\Temp\FF30.tmp"83⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"84⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"85⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\F5.tmp"C:\Users\Admin\AppData\Local\Temp\F5.tmp"86⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"87⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"88⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"89⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\376.tmp"C:\Users\Admin\AppData\Local\Temp\376.tmp"90⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"91⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"92⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"93⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5F6.tmp"C:\Users\Admin\AppData\Local\Temp\5F6.tmp"94⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"95⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"96⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"99⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"100⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"101⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"102⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"103⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"104⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"105⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"106⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"107⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"108⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\EEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEF.tmp"109⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"110⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"111⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"112⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"113⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\120C.tmp"C:\Users\Admin\AppData\Local\Temp\120C.tmp"114⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"115⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"116⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"117⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"118⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"119⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"120⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"121⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"122⤵PID:4920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-