Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65e836b6b4b3857c371870670896e343_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
65e836b6b4b3857c371870670896e343_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
65e836b6b4b3857c371870670896e343_mafia_JC.exe
-
Size
486KB
-
MD5
65e836b6b4b3857c371870670896e343
-
SHA1
1cb68386b7e8add4e438e24662eb1e24c1683528
-
SHA256
c63ad168c2e6b2098679a55834a18f50d2c00e62d9ed6e70cb758d04d19bc5f1
-
SHA512
625eaa08947605c7aa2281a1c2a300a25f9c2f1bb6f4586162a30b5fa072cf900b19d2fa2e1d71c766d95603b3a5da0fe5d90223b4bfa8f1b3ad84fea960690c
-
SSDEEP
12288:oU5rCOTeiDUY3LxUeGpzIJvDaHJyHzjMR6pNZ:oUQOJDUY3NrGpygqzYRON
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4320 20B2.tmp 2544 21FA.tmp 3752 22A6.tmp 2312 244C.tmp 3112 2517.tmp 2008 25D3.tmp 212 268E.tmp 3644 274A.tmp 3340 2834.tmp 3444 28FF.tmp 1500 2A38.tmp 1628 2B60.tmp 4716 2BFD.tmp 2420 2CF7.tmp 3848 2DE1.tmp 5088 2E9D.tmp 2200 2FC5.tmp 3956 30DF.tmp 1416 3217.tmp 884 32B3.tmp 4828 338E.tmp 3412 341B.tmp 4892 34D6.tmp 4604 364D.tmp 2120 3728.tmp 1596 37F3.tmp 900 390C.tmp 1972 39A9.tmp 404 3A83.tmp 1532 3B20.tmp 452 3BAC.tmp 4696 3C87.tmp 5092 3D04.tmp 3628 3D71.tmp 1364 3DEE.tmp 4756 3E5C.tmp 4388 3EC9.tmp 4428 3F37.tmp 4116 3FE2.tmp 3988 408E.tmp 2368 40FC.tmp 3900 4169.tmp 400 41F6.tmp 4720 4263.tmp 3960 42FF.tmp 4216 438C.tmp 4196 43F9.tmp 4040 4467.tmp 3376 4522.tmp 4524 45BE.tmp 2544 468A.tmp 3380 4716.tmp 1576 47E1.tmp 2184 488D.tmp 232 4929.tmp 2680 49B6.tmp 896 4A43.tmp 3272 4AB0.tmp 652 4B5C.tmp 728 4C27.tmp 4132 4CC3.tmp 4340 4D8E.tmp 1628 4E0B.tmp 3240 4E88.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 4320 2744 65e836b6b4b3857c371870670896e343_mafia_JC.exe 86 PID 2744 wrote to memory of 4320 2744 65e836b6b4b3857c371870670896e343_mafia_JC.exe 86 PID 2744 wrote to memory of 4320 2744 65e836b6b4b3857c371870670896e343_mafia_JC.exe 86 PID 4320 wrote to memory of 2544 4320 20B2.tmp 87 PID 4320 wrote to memory of 2544 4320 20B2.tmp 87 PID 4320 wrote to memory of 2544 4320 20B2.tmp 87 PID 2544 wrote to memory of 3752 2544 21FA.tmp 88 PID 2544 wrote to memory of 3752 2544 21FA.tmp 88 PID 2544 wrote to memory of 3752 2544 21FA.tmp 88 PID 3752 wrote to memory of 2312 3752 22A6.tmp 89 PID 3752 wrote to memory of 2312 3752 22A6.tmp 89 PID 3752 wrote to memory of 2312 3752 22A6.tmp 89 PID 2312 wrote to memory of 3112 2312 244C.tmp 90 PID 2312 wrote to memory of 3112 2312 244C.tmp 90 PID 2312 wrote to memory of 3112 2312 244C.tmp 90 PID 3112 wrote to memory of 2008 3112 2517.tmp 91 PID 3112 wrote to memory of 2008 3112 2517.tmp 91 PID 3112 wrote to memory of 2008 3112 2517.tmp 91 PID 2008 wrote to memory of 212 2008 25D3.tmp 92 PID 2008 wrote to memory of 212 2008 25D3.tmp 92 PID 2008 wrote to memory of 212 2008 25D3.tmp 92 PID 212 wrote to memory of 3644 212 268E.tmp 93 PID 212 wrote to memory of 3644 212 268E.tmp 93 PID 212 wrote to memory of 3644 212 268E.tmp 93 PID 3644 wrote to memory of 3340 3644 274A.tmp 94 PID 3644 wrote to memory of 3340 3644 274A.tmp 94 PID 3644 wrote to memory of 3340 3644 274A.tmp 94 PID 3340 wrote to memory of 3444 3340 2834.tmp 95 PID 3340 wrote to memory of 3444 3340 2834.tmp 95 PID 3340 wrote to memory of 3444 3340 2834.tmp 95 PID 3444 wrote to memory of 1500 3444 28FF.tmp 96 PID 3444 wrote to memory of 1500 3444 28FF.tmp 96 PID 3444 wrote to memory of 1500 3444 28FF.tmp 96 PID 1500 wrote to memory of 1628 1500 2A38.tmp 97 PID 1500 wrote to memory of 1628 1500 2A38.tmp 97 PID 1500 wrote to memory of 1628 1500 2A38.tmp 97 PID 1628 wrote to memory of 4716 1628 2B60.tmp 98 PID 1628 wrote to memory of 4716 1628 2B60.tmp 98 PID 1628 wrote to memory of 4716 1628 2B60.tmp 98 PID 4716 wrote to memory of 2420 4716 2BFD.tmp 99 PID 4716 wrote to memory of 2420 4716 2BFD.tmp 99 PID 4716 wrote to memory of 2420 4716 2BFD.tmp 99 PID 2420 wrote to memory of 3848 2420 2CF7.tmp 100 PID 2420 wrote to memory of 3848 2420 2CF7.tmp 100 PID 2420 wrote to memory of 3848 2420 2CF7.tmp 100 PID 3848 wrote to memory of 5088 3848 2DE1.tmp 101 PID 3848 wrote to memory of 5088 3848 2DE1.tmp 101 PID 3848 wrote to memory of 5088 3848 2DE1.tmp 101 PID 5088 wrote to memory of 2200 5088 2E9D.tmp 102 PID 5088 wrote to memory of 2200 5088 2E9D.tmp 102 PID 5088 wrote to memory of 2200 5088 2E9D.tmp 102 PID 2200 wrote to memory of 3956 2200 2FC5.tmp 103 PID 2200 wrote to memory of 3956 2200 2FC5.tmp 103 PID 2200 wrote to memory of 3956 2200 2FC5.tmp 103 PID 3956 wrote to memory of 1416 3956 30DF.tmp 104 PID 3956 wrote to memory of 1416 3956 30DF.tmp 104 PID 3956 wrote to memory of 1416 3956 30DF.tmp 104 PID 1416 wrote to memory of 884 1416 3217.tmp 105 PID 1416 wrote to memory of 884 1416 3217.tmp 105 PID 1416 wrote to memory of 884 1416 3217.tmp 105 PID 884 wrote to memory of 4828 884 32B3.tmp 106 PID 884 wrote to memory of 4828 884 32B3.tmp 106 PID 884 wrote to memory of 4828 884 32B3.tmp 106 PID 4828 wrote to memory of 3412 4828 338E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\65e836b6b4b3857c371870670896e343_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\65e836b6b4b3857c371870670896e343_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2517.tmp"C:\Users\Admin\AppData\Local\Temp\2517.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\268E.tmp"C:\Users\Admin\AppData\Local\Temp\268E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\274A.tmp"C:\Users\Admin\AppData\Local\Temp\274A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"23⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"24⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"25⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"26⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"27⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"28⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"29⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3A83.tmp"C:\Users\Admin\AppData\Local\Temp\3A83.tmp"30⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"31⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"32⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"33⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"34⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"35⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"36⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"37⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"38⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"39⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"40⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"41⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"42⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"43⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"44⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"45⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"46⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"47⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"48⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"49⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"50⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"51⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"52⤵
- Executes dropped EXE
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"53⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"54⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"55⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"56⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"57⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"58⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"59⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"60⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"61⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"62⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"63⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"64⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"65⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"66⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"67⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"68⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"69⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"71⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"72⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\52FD.tmp"C:\Users\Admin\AppData\Local\Temp\52FD.tmp"73⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"74⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"75⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"76⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"77⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"79⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"80⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"81⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"82⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"83⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"84⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"85⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"86⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"87⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"89⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"90⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"91⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"92⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"93⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"94⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"95⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"96⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"97⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"98⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"99⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"100⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"101⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"102⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"103⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"104⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"105⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"106⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"108⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"109⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"110⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"111⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"112⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"113⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"114⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"115⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"116⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"117⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"118⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\6B67.tmp"C:\Users\Admin\AppData\Local\Temp\6B67.tmp"119⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"120⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"121⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"122⤵PID:4100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-