Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 14:33
Static task
static1
Behavioral task
behavioral1
Sample
5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe
-
Size
486KB
-
MD5
5713f6a86efac45d6d65edb26ec0018e
-
SHA1
a53edf4253b5563cc041c0a75096f453634bc9d1
-
SHA256
440286c4c5535dcbaf6c55d2b4cd588e31bfb1ca7a23ea69c8bbe52c57b55106
-
SHA512
62356bc6ca0d5599b15a4703c9f1e8de763cb2b2363ed58710a3cbee79ff897c278742d1d93cf1ea61fc72040b6db91e9dfa189180b44db0ab7c697ae1c35322
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7YAtLyj0R3M6TRXDHzYYPEFYC0n7jtgn1qauL:/U5rCOTeiDLRyp2zH85FV0vi+xT3NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4928 689D.tmp 448 6959.tmp 868 69D6.tmp 4240 6B1E.tmp 3660 6BBA.tmp 4636 6C85.tmp 1248 6D12.tmp 4400 6DBE.tmp 2404 6E4A.tmp 1632 6ED7.tmp 4432 7119.tmp 4876 71D4.tmp 824 7261.tmp 2180 730D.tmp 3992 73A9.tmp 2940 7511.tmp 4972 75EB.tmp 4936 76A7.tmp 4620 7733.tmp 3996 77DF.tmp 4024 788B.tmp 4304 7918.tmp 4296 79A4.tmp 1136 7A41.tmp 904 7BA8.tmp 2252 7C35.tmp 4624 7CE1.tmp 4812 7D8C.tmp 4808 7E29.tmp 4412 7EC5.tmp 5004 7F61.tmp 3400 80E8.tmp 500 81A3.tmp 2812 8240.tmp 2732 82DC.tmp 3404 8378.tmp 1416 83F5.tmp 3516 84B1.tmp 3800 853D.tmp 1752 85E9.tmp 4252 8656.tmp 1008 8702.tmp 1696 877F.tmp 4744 87ED.tmp 1032 8879.tmp 464 8954.tmp 3208 89D1.tmp 4044 8A7D.tmp 2204 8AFA.tmp 4120 8B67.tmp 2948 8BF4.tmp 3040 8C81.tmp 1456 8D1D.tmp 1248 8DA9.tmp 1124 8E17.tmp 3032 8E84.tmp 2404 8F11.tmp 4012 8FBD.tmp 4604 9049.tmp 488 90C6.tmp 1284 9134.tmp 3080 9191.tmp 392 91EF.tmp 2240 926C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4928 5112 5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe 85 PID 5112 wrote to memory of 4928 5112 5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe 85 PID 5112 wrote to memory of 4928 5112 5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe 85 PID 4928 wrote to memory of 448 4928 689D.tmp 87 PID 4928 wrote to memory of 448 4928 689D.tmp 87 PID 4928 wrote to memory of 448 4928 689D.tmp 87 PID 448 wrote to memory of 868 448 6959.tmp 88 PID 448 wrote to memory of 868 448 6959.tmp 88 PID 448 wrote to memory of 868 448 6959.tmp 88 PID 868 wrote to memory of 4240 868 69D6.tmp 89 PID 868 wrote to memory of 4240 868 69D6.tmp 89 PID 868 wrote to memory of 4240 868 69D6.tmp 89 PID 4240 wrote to memory of 3660 4240 6B1E.tmp 90 PID 4240 wrote to memory of 3660 4240 6B1E.tmp 90 PID 4240 wrote to memory of 3660 4240 6B1E.tmp 90 PID 3660 wrote to memory of 4636 3660 6BBA.tmp 91 PID 3660 wrote to memory of 4636 3660 6BBA.tmp 91 PID 3660 wrote to memory of 4636 3660 6BBA.tmp 91 PID 4636 wrote to memory of 1248 4636 6C85.tmp 92 PID 4636 wrote to memory of 1248 4636 6C85.tmp 92 PID 4636 wrote to memory of 1248 4636 6C85.tmp 92 PID 1248 wrote to memory of 4400 1248 6D12.tmp 93 PID 1248 wrote to memory of 4400 1248 6D12.tmp 93 PID 1248 wrote to memory of 4400 1248 6D12.tmp 93 PID 4400 wrote to memory of 2404 4400 6DBE.tmp 94 PID 4400 wrote to memory of 2404 4400 6DBE.tmp 94 PID 4400 wrote to memory of 2404 4400 6DBE.tmp 94 PID 2404 wrote to memory of 1632 2404 6E4A.tmp 95 PID 2404 wrote to memory of 1632 2404 6E4A.tmp 95 PID 2404 wrote to memory of 1632 2404 6E4A.tmp 95 PID 1632 wrote to memory of 4432 1632 6ED7.tmp 96 PID 1632 wrote to memory of 4432 1632 6ED7.tmp 96 PID 1632 wrote to memory of 4432 1632 6ED7.tmp 96 PID 4432 wrote to memory of 4876 4432 7119.tmp 97 PID 4432 wrote to memory of 4876 4432 7119.tmp 97 PID 4432 wrote to memory of 4876 4432 7119.tmp 97 PID 4876 wrote to memory of 824 4876 71D4.tmp 98 PID 4876 wrote to memory of 824 4876 71D4.tmp 98 PID 4876 wrote to memory of 824 4876 71D4.tmp 98 PID 824 wrote to memory of 2180 824 7261.tmp 99 PID 824 wrote to memory of 2180 824 7261.tmp 99 PID 824 wrote to memory of 2180 824 7261.tmp 99 PID 2180 wrote to memory of 3992 2180 730D.tmp 102 PID 2180 wrote to memory of 3992 2180 730D.tmp 102 PID 2180 wrote to memory of 3992 2180 730D.tmp 102 PID 3992 wrote to memory of 2940 3992 73A9.tmp 103 PID 3992 wrote to memory of 2940 3992 73A9.tmp 103 PID 3992 wrote to memory of 2940 3992 73A9.tmp 103 PID 2940 wrote to memory of 4972 2940 7511.tmp 104 PID 2940 wrote to memory of 4972 2940 7511.tmp 104 PID 2940 wrote to memory of 4972 2940 7511.tmp 104 PID 4972 wrote to memory of 4936 4972 75EB.tmp 105 PID 4972 wrote to memory of 4936 4972 75EB.tmp 105 PID 4972 wrote to memory of 4936 4972 75EB.tmp 105 PID 4936 wrote to memory of 4620 4936 76A7.tmp 106 PID 4936 wrote to memory of 4620 4936 76A7.tmp 106 PID 4936 wrote to memory of 4620 4936 76A7.tmp 106 PID 4620 wrote to memory of 3996 4620 7733.tmp 107 PID 4620 wrote to memory of 3996 4620 7733.tmp 107 PID 4620 wrote to memory of 3996 4620 7733.tmp 107 PID 3996 wrote to memory of 4024 3996 77DF.tmp 109 PID 3996 wrote to memory of 4024 3996 77DF.tmp 109 PID 3996 wrote to memory of 4024 3996 77DF.tmp 109 PID 4024 wrote to memory of 4304 4024 788B.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5713f6a86efac45d6d65edb26ec0018e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"23⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"24⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"25⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"26⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"27⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"28⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"29⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"30⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"31⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"32⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"33⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"34⤵
- Executes dropped EXE
PID:500 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"35⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"36⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"37⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"38⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"39⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"40⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"41⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"42⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"43⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"44⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"45⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"46⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"47⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"48⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"49⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"50⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"51⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"52⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"53⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"54⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"55⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"56⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"57⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"58⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"59⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"60⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"61⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"62⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"63⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"64⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"65⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"66⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"67⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"68⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"69⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"70⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"71⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"72⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"73⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"74⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"75⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"76⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"77⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"78⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"79⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"80⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"81⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"82⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"83⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"84⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"85⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"86⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"87⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"88⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"89⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"90⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"91⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"92⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"93⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"94⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"95⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"96⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"97⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"98⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"99⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"100⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"101⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"102⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"103⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"104⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"105⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"106⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"107⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"108⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"109⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"110⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"111⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"112⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"113⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"114⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"115⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"116⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"117⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"118⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"119⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"120⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"121⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"122⤵PID:4936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-