Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe
-
Size
520KB
-
MD5
560ab098cc6e5c4e3aea98d1726385cb
-
SHA1
8a0d1808f93e7c77312bf01cb1ba5b9a27a2deac
-
SHA256
0886a2e2139eae939cdd6885c876678780b568f46f5683c25fd73bd46e04751c
-
SHA512
9b0fc5d8dd499d67bcf3af14c840ea7eab79c21bed737591ce4794190daa8d44b3fd7b426bbdc24559388669b505b5db1819f3abb0bc00862b794e083246f661
-
SSDEEP
12288:gj8fuxR21t5i8fcT00QnO/BEEofadUr2ejrNZ:gj8fuK1GYa1EEWadUr2QrN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1580 D8CC.tmp 3252 D987.tmp 4400 DA14.tmp 3188 DADF.tmp 3504 DC08.tmp 4136 DCB4.tmp 2060 DD50.tmp 32 DDCD.tmp 4380 DE5A.tmp 4016 DEF6.tmp 1056 DFC1.tmp 3828 E04E.tmp 1264 E0EA.tmp 1036 E37A.tmp 4720 E3F7.tmp 4268 E474.tmp 4732 E520.tmp 880 E59D.tmp 3748 E6A7.tmp 5052 E724.tmp 544 E7DF.tmp 2956 E86C.tmp 4704 E8F8.tmp 1192 E966.tmp 4168 EA02.tmp 2968 EA8F.tmp 4008 EB3B.tmp 4620 EBD7.tmp 1332 EC63.tmp 1216 ED2F.tmp 4544 EDBB.tmp 1616 EE57.tmp 2184 EEF4.tmp 4036 EF61.tmp 4496 EFDE.tmp 2500 F04B.tmp 2648 F0C8.tmp 4200 F136.tmp 2668 F1C2.tmp 4744 F349.tmp 5076 F3C6.tmp 3188 F453.tmp 636 F4DF.tmp 4332 F56C.tmp 2440 F656.tmp 3752 F6F3.tmp 32 F770.tmp 2684 F80C.tmp 1796 F889.tmp 552 F915.tmp 1776 F992.tmp 1620 FA0F.tmp 1136 FABB.tmp 804 FB29.tmp 1608 FBD5.tmp 3936 FC52.tmp 228 FCDE.tmp 4532 FD5B.tmp 2528 FDE8.tmp 2900 FE74.tmp 4788 FF01.tmp 4992 FF8E.tmp 4504 3A.tmp 4756 C6.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 1580 4496 2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe 85 PID 4496 wrote to memory of 1580 4496 2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe 85 PID 4496 wrote to memory of 1580 4496 2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe 85 PID 1580 wrote to memory of 3252 1580 D8CC.tmp 86 PID 1580 wrote to memory of 3252 1580 D8CC.tmp 86 PID 1580 wrote to memory of 3252 1580 D8CC.tmp 86 PID 3252 wrote to memory of 4400 3252 D987.tmp 88 PID 3252 wrote to memory of 4400 3252 D987.tmp 88 PID 3252 wrote to memory of 4400 3252 D987.tmp 88 PID 4400 wrote to memory of 3188 4400 DA14.tmp 89 PID 4400 wrote to memory of 3188 4400 DA14.tmp 89 PID 4400 wrote to memory of 3188 4400 DA14.tmp 89 PID 3188 wrote to memory of 3504 3188 DADF.tmp 90 PID 3188 wrote to memory of 3504 3188 DADF.tmp 90 PID 3188 wrote to memory of 3504 3188 DADF.tmp 90 PID 3504 wrote to memory of 4136 3504 DC08.tmp 91 PID 3504 wrote to memory of 4136 3504 DC08.tmp 91 PID 3504 wrote to memory of 4136 3504 DC08.tmp 91 PID 4136 wrote to memory of 2060 4136 DCB4.tmp 92 PID 4136 wrote to memory of 2060 4136 DCB4.tmp 92 PID 4136 wrote to memory of 2060 4136 DCB4.tmp 92 PID 2060 wrote to memory of 32 2060 DD50.tmp 93 PID 2060 wrote to memory of 32 2060 DD50.tmp 93 PID 2060 wrote to memory of 32 2060 DD50.tmp 93 PID 32 wrote to memory of 4380 32 DDCD.tmp 94 PID 32 wrote to memory of 4380 32 DDCD.tmp 94 PID 32 wrote to memory of 4380 32 DDCD.tmp 94 PID 4380 wrote to memory of 4016 4380 DE5A.tmp 95 PID 4380 wrote to memory of 4016 4380 DE5A.tmp 95 PID 4380 wrote to memory of 4016 4380 DE5A.tmp 95 PID 4016 wrote to memory of 1056 4016 DEF6.tmp 96 PID 4016 wrote to memory of 1056 4016 DEF6.tmp 96 PID 4016 wrote to memory of 1056 4016 DEF6.tmp 96 PID 1056 wrote to memory of 3828 1056 DFC1.tmp 97 PID 1056 wrote to memory of 3828 1056 DFC1.tmp 97 PID 1056 wrote to memory of 3828 1056 DFC1.tmp 97 PID 3828 wrote to memory of 1264 3828 E04E.tmp 98 PID 3828 wrote to memory of 1264 3828 E04E.tmp 98 PID 3828 wrote to memory of 1264 3828 E04E.tmp 98 PID 1264 wrote to memory of 1036 1264 E0EA.tmp 99 PID 1264 wrote to memory of 1036 1264 E0EA.tmp 99 PID 1264 wrote to memory of 1036 1264 E0EA.tmp 99 PID 1036 wrote to memory of 4720 1036 E37A.tmp 101 PID 1036 wrote to memory of 4720 1036 E37A.tmp 101 PID 1036 wrote to memory of 4720 1036 E37A.tmp 101 PID 4720 wrote to memory of 4268 4720 E3F7.tmp 104 PID 4720 wrote to memory of 4268 4720 E3F7.tmp 104 PID 4720 wrote to memory of 4268 4720 E3F7.tmp 104 PID 4268 wrote to memory of 4732 4268 E474.tmp 105 PID 4268 wrote to memory of 4732 4268 E474.tmp 105 PID 4268 wrote to memory of 4732 4268 E474.tmp 105 PID 4732 wrote to memory of 880 4732 E520.tmp 106 PID 4732 wrote to memory of 880 4732 E520.tmp 106 PID 4732 wrote to memory of 880 4732 E520.tmp 106 PID 880 wrote to memory of 3748 880 E59D.tmp 107 PID 880 wrote to memory of 3748 880 E59D.tmp 107 PID 880 wrote to memory of 3748 880 E59D.tmp 107 PID 3748 wrote to memory of 5052 3748 E6A7.tmp 109 PID 3748 wrote to memory of 5052 3748 E6A7.tmp 109 PID 3748 wrote to memory of 5052 3748 E6A7.tmp 109 PID 5052 wrote to memory of 544 5052 E724.tmp 110 PID 5052 wrote to memory of 544 5052 E724.tmp 110 PID 5052 wrote to memory of 544 5052 E724.tmp 110 PID 544 wrote to memory of 2956 544 E7DF.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_560ab098cc6e5c4e3aea98d1726385cb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"C:\Users\Admin\AppData\Local\Temp\D8CC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\D987.tmp"C:\Users\Admin\AppData\Local\Temp\D987.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"23⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"24⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"25⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"26⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"27⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"28⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"29⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"30⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"31⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"32⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"33⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"34⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"35⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"36⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"37⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"38⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"39⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"40⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"41⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"42⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"43⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"C:\Users\Admin\AppData\Local\Temp\F4DF.tmp"44⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"45⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"46⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"47⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"48⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"49⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"50⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"51⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"52⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"53⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\FABB.tmp"C:\Users\Admin\AppData\Local\Temp\FABB.tmp"54⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"55⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"C:\Users\Admin\AppData\Local\Temp\FBD5.tmp"56⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"57⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"58⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"59⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"60⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"61⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"62⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"63⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\3A.tmp"C:\Users\Admin\AppData\Local\Temp\3A.tmp"64⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"65⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"67⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"68⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\29B.tmp"C:\Users\Admin\AppData\Local\Temp\29B.tmp"69⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"71⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\422.tmp"C:\Users\Admin\AppData\Local\Temp\422.tmp"72⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"74⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"75⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\625.tmp"C:\Users\Admin\AppData\Local\Temp\625.tmp"76⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\693.tmp"C:\Users\Admin\AppData\Local\Temp\693.tmp"77⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"78⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"79⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"80⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"81⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"82⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"83⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"84⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"85⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"86⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"87⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\CAD.tmp"C:\Users\Admin\AppData\Local\Temp\CAD.tmp"88⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"89⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"90⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"91⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"92⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"93⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"94⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"95⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\1102.tmp"C:\Users\Admin\AppData\Local\Temp\1102.tmp"96⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"97⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"98⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"99⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"100⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"101⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\13E1.tmp"C:\Users\Admin\AppData\Local\Temp\13E1.tmp"102⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"103⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"104⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"105⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"106⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"108⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"109⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"110⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\1894.tmp"C:\Users\Admin\AppData\Local\Temp\1894.tmp"111⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"112⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"113⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"114⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"C:\Users\Admin\AppData\Local\Temp\1AA7.tmp"115⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"116⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"117⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"118⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"119⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"120⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"122⤵PID:4472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-