Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe
-
Size
486KB
-
MD5
5f040ded735125e39ae1db534a0db7ca
-
SHA1
50bf81f0f53712d80da9a8fd049df688d88925db
-
SHA256
856c0d3eb006fcdeb418b8d995e971c237548ac79fcab49467fea692be20a622
-
SHA512
b01817445c135de872eb6156100c31a05655512c0b11d0039688a9df00ec9e36ae35f4cfefbd336c15c4a4a4603791dd0147d12489adbf6ca15ae8f5ba37be82
-
SSDEEP
12288:oU5rCOTeiDt0a8QqeM2rnLqv0HpRBJIz683NZ:oUQOJDOQXTG8HpJIeON
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1308 929B.tmp 4296 9357.tmp 1936 9402.tmp 708 949F.tmp 3388 956A.tmp 4604 9635.tmp 3176 96E1.tmp 4724 978D.tmp 4856 980A.tmp 4464 98E4.tmp 3148 99BF.tmp 3676 9A3C.tmp 2872 9AE8.tmp 652 9BA4.tmp 3188 9C8E.tmp 2324 9D0B.tmp 4260 9DA7.tmp 1376 9E43.tmp 3972 9EFF.tmp 2628 9FDA.tmp 568 A076.tmp 3796 A160.tmp 3808 A21C.tmp 4788 A2B8.tmp 1636 A374.tmp 3636 A43F.tmp 2596 A529.tmp 2776 A604.tmp 3740 A690.tmp 2820 A75C.tmp 2184 A836.tmp 2008 A921.tmp 3232 AA2A.tmp 4764 AAE6.tmp 2888 ABA1.tmp 1300 AC2E.tmp 1288 AC9B.tmp 3624 AD28.tmp 5084 ADB5.tmp 1280 AE51.tmp 3160 AEED.tmp 3664 AF89.tmp 1208 B026.tmp 1620 B0C2.tmp 1044 B16E.tmp 1684 B21A.tmp 1676 B297.tmp 3656 B342.tmp 1588 B3FE.tmp 1632 B47B.tmp 2152 B585.tmp 5020 B611.tmp 1992 B68E.tmp 5028 B74A.tmp 4052 B7C7.tmp 5092 B844.tmp 1452 B8B1.tmp 3124 B92E.tmp 1536 B98C.tmp 3188 B9EA.tmp 4132 BA76.tmp 1908 BB03.tmp 2612 BB8F.tmp 1376 BC0C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1308 1656 5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe 84 PID 1656 wrote to memory of 1308 1656 5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe 84 PID 1656 wrote to memory of 1308 1656 5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe 84 PID 1308 wrote to memory of 4296 1308 929B.tmp 85 PID 1308 wrote to memory of 4296 1308 929B.tmp 85 PID 1308 wrote to memory of 4296 1308 929B.tmp 85 PID 4296 wrote to memory of 1936 4296 9357.tmp 87 PID 4296 wrote to memory of 1936 4296 9357.tmp 87 PID 4296 wrote to memory of 1936 4296 9357.tmp 87 PID 1936 wrote to memory of 708 1936 9402.tmp 88 PID 1936 wrote to memory of 708 1936 9402.tmp 88 PID 1936 wrote to memory of 708 1936 9402.tmp 88 PID 708 wrote to memory of 3388 708 949F.tmp 89 PID 708 wrote to memory of 3388 708 949F.tmp 89 PID 708 wrote to memory of 3388 708 949F.tmp 89 PID 3388 wrote to memory of 4604 3388 956A.tmp 90 PID 3388 wrote to memory of 4604 3388 956A.tmp 90 PID 3388 wrote to memory of 4604 3388 956A.tmp 90 PID 4604 wrote to memory of 3176 4604 9635.tmp 91 PID 4604 wrote to memory of 3176 4604 9635.tmp 91 PID 4604 wrote to memory of 3176 4604 9635.tmp 91 PID 3176 wrote to memory of 4724 3176 96E1.tmp 92 PID 3176 wrote to memory of 4724 3176 96E1.tmp 92 PID 3176 wrote to memory of 4724 3176 96E1.tmp 92 PID 4724 wrote to memory of 4856 4724 978D.tmp 93 PID 4724 wrote to memory of 4856 4724 978D.tmp 93 PID 4724 wrote to memory of 4856 4724 978D.tmp 93 PID 4856 wrote to memory of 4464 4856 980A.tmp 94 PID 4856 wrote to memory of 4464 4856 980A.tmp 94 PID 4856 wrote to memory of 4464 4856 980A.tmp 94 PID 4464 wrote to memory of 3148 4464 98E4.tmp 95 PID 4464 wrote to memory of 3148 4464 98E4.tmp 95 PID 4464 wrote to memory of 3148 4464 98E4.tmp 95 PID 3148 wrote to memory of 3676 3148 99BF.tmp 96 PID 3148 wrote to memory of 3676 3148 99BF.tmp 96 PID 3148 wrote to memory of 3676 3148 99BF.tmp 96 PID 3676 wrote to memory of 2872 3676 9A3C.tmp 97 PID 3676 wrote to memory of 2872 3676 9A3C.tmp 97 PID 3676 wrote to memory of 2872 3676 9A3C.tmp 97 PID 2872 wrote to memory of 652 2872 9AE8.tmp 98 PID 2872 wrote to memory of 652 2872 9AE8.tmp 98 PID 2872 wrote to memory of 652 2872 9AE8.tmp 98 PID 652 wrote to memory of 3188 652 9BA4.tmp 101 PID 652 wrote to memory of 3188 652 9BA4.tmp 101 PID 652 wrote to memory of 3188 652 9BA4.tmp 101 PID 3188 wrote to memory of 2324 3188 9C8E.tmp 102 PID 3188 wrote to memory of 2324 3188 9C8E.tmp 102 PID 3188 wrote to memory of 2324 3188 9C8E.tmp 102 PID 2324 wrote to memory of 4260 2324 9D0B.tmp 103 PID 2324 wrote to memory of 4260 2324 9D0B.tmp 103 PID 2324 wrote to memory of 4260 2324 9D0B.tmp 103 PID 4260 wrote to memory of 1376 4260 9DA7.tmp 104 PID 4260 wrote to memory of 1376 4260 9DA7.tmp 104 PID 4260 wrote to memory of 1376 4260 9DA7.tmp 104 PID 1376 wrote to memory of 3972 1376 9E43.tmp 105 PID 1376 wrote to memory of 3972 1376 9E43.tmp 105 PID 1376 wrote to memory of 3972 1376 9E43.tmp 105 PID 3972 wrote to memory of 2628 3972 9EFF.tmp 106 PID 3972 wrote to memory of 2628 3972 9EFF.tmp 106 PID 3972 wrote to memory of 2628 3972 9EFF.tmp 106 PID 2628 wrote to memory of 568 2628 9FDA.tmp 108 PID 2628 wrote to memory of 568 2628 9FDA.tmp 108 PID 2628 wrote to memory of 568 2628 9FDA.tmp 108 PID 568 wrote to memory of 3796 568 A076.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5f040ded735125e39ae1db534a0db7ca_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"23⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"24⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"25⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"26⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"27⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"28⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"29⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"30⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"31⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"32⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"33⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"34⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"35⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"36⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"37⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"38⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"39⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"40⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"41⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"42⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"43⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"44⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"45⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"46⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"47⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"48⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"49⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"50⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"51⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"52⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"53⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"54⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"55⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"56⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"57⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"58⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"59⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"60⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"61⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"62⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"63⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"64⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"65⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"66⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"67⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"68⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"69⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"70⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"72⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"73⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"74⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"75⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"76⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"77⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"78⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"79⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"80⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"81⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"82⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"83⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"84⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"85⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"86⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"87⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"88⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"89⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"90⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"91⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"92⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"93⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"94⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"95⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"96⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"97⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"98⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"99⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"100⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"101⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"102⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"103⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"104⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\D06F.tmp"C:\Users\Admin\AppData\Local\Temp\D06F.tmp"105⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"106⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"107⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"108⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"109⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"110⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"111⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"112⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"113⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"114⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"115⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"116⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"117⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"118⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\D83F.tmp"C:\Users\Admin\AppData\Local\Temp\D83F.tmp"119⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"120⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\D958.tmp"C:\Users\Admin\AppData\Local\Temp\D958.tmp"121⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"122⤵PID:3856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-