Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2023, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe
-
Size
520KB
-
MD5
45bff3dd419e504478560bb20bdc58b9
-
SHA1
0a18119659b73ec8ab9c02f7184afb627ca4a52b
-
SHA256
afdf1035111467dc5d85bc831c6a7cd23586121eaef300f191efebe819256dcc
-
SHA512
293f5e7798dcf6a7d857dcab1102b1bdbcc4e8131e1d5adb04c7f76d02ce32e13b127b8259359bacab48acf63ced4dee7b5488d94638fda75eea9be806166013
-
SSDEEP
12288:Wth5fWfNpWlMu8dJQq4ZvKr4RcQbhqbmmpnxiCkdjNZ:WtjefelMsq4K4xYbTpnIVjN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 576 7D7D.tmp 4180 7E48.tmp 636 7F32.tmp 4192 802C.tmp 3416 8107.tmp 4428 8211.tmp 3544 82CC.tmp 732 83B7.tmp 464 8453.tmp 2840 850E.tmp 3192 85D9.tmp 1820 8695.tmp 4564 87DD.tmp 1064 8916.tmp 2696 89C1.tmp 3920 8A9C.tmp 1964 8B87.tmp 4932 8C23.tmp 1740 8CFE.tmp 436 8DD8.tmp 2632 8ED2.tmp 2788 8FAD.tmp 1108 9078.tmp 3884 9134.tmp 3772 922E.tmp 4920 92BA.tmp 2316 9385.tmp 4292 9402.tmp 4296 948F.tmp 2836 953B.tmp 2044 9625.tmp 4804 96E1.tmp 716 97BC.tmp 1236 9829.tmp 1604 9896.tmp 2884 9923.tmp 1700 99A0.tmp 3812 9A3C.tmp 4848 9AC9.tmp 1832 9B65.tmp 1516 9BE2.tmp 3688 9C6F.tmp 2716 9CFB.tmp 3100 9D78.tmp 3848 9E15.tmp 8 9E92.tmp 780 9F2E.tmp 3164 9FBA.tmp 1300 A047.tmp 4168 A0D4.tmp 4180 A170.tmp 492 A1FD.tmp 4220 A27A.tmp 4740 A2F7.tmp 3480 A393.tmp 1284 A410.tmp 1360 A48D.tmp 3392 A50A.tmp 4816 A587.tmp 4480 A604.tmp 4600 A690.tmp 1076 A70D.tmp 552 A7AA.tmp 2368 A846.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 576 4408 45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe 80 PID 4408 wrote to memory of 576 4408 45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe 80 PID 4408 wrote to memory of 576 4408 45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe 80 PID 576 wrote to memory of 4180 576 7D7D.tmp 81 PID 576 wrote to memory of 4180 576 7D7D.tmp 81 PID 576 wrote to memory of 4180 576 7D7D.tmp 81 PID 4180 wrote to memory of 636 4180 7E48.tmp 82 PID 4180 wrote to memory of 636 4180 7E48.tmp 82 PID 4180 wrote to memory of 636 4180 7E48.tmp 82 PID 636 wrote to memory of 4192 636 7F32.tmp 83 PID 636 wrote to memory of 4192 636 7F32.tmp 83 PID 636 wrote to memory of 4192 636 7F32.tmp 83 PID 4192 wrote to memory of 3416 4192 802C.tmp 84 PID 4192 wrote to memory of 3416 4192 802C.tmp 84 PID 4192 wrote to memory of 3416 4192 802C.tmp 84 PID 3416 wrote to memory of 4428 3416 8107.tmp 85 PID 3416 wrote to memory of 4428 3416 8107.tmp 85 PID 3416 wrote to memory of 4428 3416 8107.tmp 85 PID 4428 wrote to memory of 3544 4428 8211.tmp 86 PID 4428 wrote to memory of 3544 4428 8211.tmp 86 PID 4428 wrote to memory of 3544 4428 8211.tmp 86 PID 3544 wrote to memory of 732 3544 82CC.tmp 87 PID 3544 wrote to memory of 732 3544 82CC.tmp 87 PID 3544 wrote to memory of 732 3544 82CC.tmp 87 PID 732 wrote to memory of 464 732 83B7.tmp 88 PID 732 wrote to memory of 464 732 83B7.tmp 88 PID 732 wrote to memory of 464 732 83B7.tmp 88 PID 464 wrote to memory of 2840 464 8453.tmp 89 PID 464 wrote to memory of 2840 464 8453.tmp 89 PID 464 wrote to memory of 2840 464 8453.tmp 89 PID 2840 wrote to memory of 3192 2840 850E.tmp 91 PID 2840 wrote to memory of 3192 2840 850E.tmp 91 PID 2840 wrote to memory of 3192 2840 850E.tmp 91 PID 3192 wrote to memory of 1820 3192 85D9.tmp 92 PID 3192 wrote to memory of 1820 3192 85D9.tmp 92 PID 3192 wrote to memory of 1820 3192 85D9.tmp 92 PID 1820 wrote to memory of 4564 1820 8695.tmp 93 PID 1820 wrote to memory of 4564 1820 8695.tmp 93 PID 1820 wrote to memory of 4564 1820 8695.tmp 93 PID 4564 wrote to memory of 1064 4564 87DD.tmp 94 PID 4564 wrote to memory of 1064 4564 87DD.tmp 94 PID 4564 wrote to memory of 1064 4564 87DD.tmp 94 PID 1064 wrote to memory of 2696 1064 8916.tmp 95 PID 1064 wrote to memory of 2696 1064 8916.tmp 95 PID 1064 wrote to memory of 2696 1064 8916.tmp 95 PID 2696 wrote to memory of 3920 2696 89C1.tmp 96 PID 2696 wrote to memory of 3920 2696 89C1.tmp 96 PID 2696 wrote to memory of 3920 2696 89C1.tmp 96 PID 3920 wrote to memory of 1964 3920 8A9C.tmp 97 PID 3920 wrote to memory of 1964 3920 8A9C.tmp 97 PID 3920 wrote to memory of 1964 3920 8A9C.tmp 97 PID 1964 wrote to memory of 4932 1964 8B87.tmp 98 PID 1964 wrote to memory of 4932 1964 8B87.tmp 98 PID 1964 wrote to memory of 4932 1964 8B87.tmp 98 PID 4932 wrote to memory of 1740 4932 8C23.tmp 99 PID 4932 wrote to memory of 1740 4932 8C23.tmp 99 PID 4932 wrote to memory of 1740 4932 8C23.tmp 99 PID 1740 wrote to memory of 436 1740 8CFE.tmp 102 PID 1740 wrote to memory of 436 1740 8CFE.tmp 102 PID 1740 wrote to memory of 436 1740 8CFE.tmp 102 PID 436 wrote to memory of 2632 436 8DD8.tmp 103 PID 436 wrote to memory of 2632 436 8DD8.tmp 103 PID 436 wrote to memory of 2632 436 8DD8.tmp 103 PID 2632 wrote to memory of 2788 2632 8ED2.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\45bff3dd419e504478560bb20bdc58b9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"23⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"24⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"25⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"26⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"27⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"28⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"29⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"30⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"31⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"32⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"33⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"34⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"35⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"36⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"37⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"38⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"39⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"40⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"41⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"42⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"43⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"44⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"45⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"46⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"47⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"48⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"49⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"50⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"51⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"52⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"53⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"54⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"55⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"56⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"57⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"58⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"59⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"60⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"61⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"62⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"63⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"64⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"65⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"67⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"68⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"69⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"70⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"71⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"72⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"73⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"74⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"75⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"76⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"77⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"78⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"79⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"80⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"81⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"82⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"83⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"84⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"85⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"86⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"87⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"88⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"89⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"90⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"91⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"92⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"93⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"94⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"95⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"96⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"97⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"98⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"99⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"100⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"101⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"102⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"104⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"105⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"106⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"107⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"108⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"109⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"110⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"111⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"112⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"113⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"114⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"115⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"116⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"117⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"118⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"119⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"120⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"121⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-