Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe
-
Size
488KB
-
MD5
19d441318eed6cfe6d448d25bc23d628
-
SHA1
de15f5e55151bceddb38cb11d5dbf3927df2b35a
-
SHA256
4ecf57d14e3188955a11949f146dd3ff44f86a26e623815e9cd55ff5fce6d8e7
-
SHA512
ec192b38009939dd6861522f116c789749ee3ff1ba6a38e22fc74fb00c6d597dd0c1aae2d383d6363f76b07fb51bcb58651f2f2849e51d08467a75b8a39a7428
-
SSDEEP
12288:/U5rCOTeiD9yhvoCwWUzB96iUc4dj17dAasWNZ:/UQOJD8Gzzv+DN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 556 E6F5.tmp 4368 E7EF.tmp 1996 E8BA.tmp 4724 EA12.tmp 3640 EB1B.tmp 1212 EC06.tmp 3940 ED0F.tmp 1592 EDAC.tmp 5044 EE48.tmp 4920 EEE4.tmp 1352 EFCE.tmp 4936 F0D8.tmp 2376 F1F1.tmp 4760 F2BC.tmp 1496 F397.tmp 2940 F4A1.tmp 4072 F54D.tmp 1944 F5F9.tmp 1536 F6A4.tmp 4340 F77F.tmp 3048 F80C.tmp 1764 F8E7.tmp 2792 F9D1.tmp 4888 FAAC.tmp 2168 FBA6.tmp 1072 FCAF.tmp 4148 FD9A.tmp 4680 FE55.tmp 4564 FF4F.tmp 1904 B.tmp 5092 E5.tmp 4740 1C0.tmp 3208 28B.tmp 2092 328.tmp 4892 3C4.tmp 4964 441.tmp 1572 4BE.tmp 1928 5B8.tmp 1936 654.tmp 3232 6D1.tmp 180 75E.tmp 4132 7DB.tmp 1876 867.tmp 4456 913.tmp 1344 9AF.tmp 1796 A1D.tmp 3860 AA9.tmp 2568 B26.tmp 3800 BB3.tmp 3336 C30.tmp 5088 CCC.tmp 2644 D59.tmp 2132 DE6.tmp 3524 E82.tmp 556 F3D.tmp 4348 FDA.tmp 1996 1085.tmp 4764 1112.tmp 1244 119F.tmp 2104 121C.tmp 1512 12A8.tmp 3556 1345.tmp 3284 13C2.tmp 4512 146D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3524 wrote to memory of 556 3524 19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe 82 PID 3524 wrote to memory of 556 3524 19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe 82 PID 3524 wrote to memory of 556 3524 19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe 82 PID 556 wrote to memory of 4368 556 E6F5.tmp 83 PID 556 wrote to memory of 4368 556 E6F5.tmp 83 PID 556 wrote to memory of 4368 556 E6F5.tmp 83 PID 4368 wrote to memory of 1996 4368 E7EF.tmp 84 PID 4368 wrote to memory of 1996 4368 E7EF.tmp 84 PID 4368 wrote to memory of 1996 4368 E7EF.tmp 84 PID 1996 wrote to memory of 4724 1996 E8BA.tmp 85 PID 1996 wrote to memory of 4724 1996 E8BA.tmp 85 PID 1996 wrote to memory of 4724 1996 E8BA.tmp 85 PID 4724 wrote to memory of 3640 4724 EA12.tmp 86 PID 4724 wrote to memory of 3640 4724 EA12.tmp 86 PID 4724 wrote to memory of 3640 4724 EA12.tmp 86 PID 3640 wrote to memory of 1212 3640 EB1B.tmp 87 PID 3640 wrote to memory of 1212 3640 EB1B.tmp 87 PID 3640 wrote to memory of 1212 3640 EB1B.tmp 87 PID 1212 wrote to memory of 3940 1212 EC06.tmp 88 PID 1212 wrote to memory of 3940 1212 EC06.tmp 88 PID 1212 wrote to memory of 3940 1212 EC06.tmp 88 PID 3940 wrote to memory of 1592 3940 ED0F.tmp 89 PID 3940 wrote to memory of 1592 3940 ED0F.tmp 89 PID 3940 wrote to memory of 1592 3940 ED0F.tmp 89 PID 1592 wrote to memory of 5044 1592 EDAC.tmp 90 PID 1592 wrote to memory of 5044 1592 EDAC.tmp 90 PID 1592 wrote to memory of 5044 1592 EDAC.tmp 90 PID 5044 wrote to memory of 4920 5044 EE48.tmp 91 PID 5044 wrote to memory of 4920 5044 EE48.tmp 91 PID 5044 wrote to memory of 4920 5044 EE48.tmp 91 PID 4920 wrote to memory of 1352 4920 EEE4.tmp 92 PID 4920 wrote to memory of 1352 4920 EEE4.tmp 92 PID 4920 wrote to memory of 1352 4920 EEE4.tmp 92 PID 1352 wrote to memory of 4936 1352 EFCE.tmp 93 PID 1352 wrote to memory of 4936 1352 EFCE.tmp 93 PID 1352 wrote to memory of 4936 1352 EFCE.tmp 93 PID 4936 wrote to memory of 2376 4936 F0D8.tmp 94 PID 4936 wrote to memory of 2376 4936 F0D8.tmp 94 PID 4936 wrote to memory of 2376 4936 F0D8.tmp 94 PID 2376 wrote to memory of 4760 2376 F1F1.tmp 95 PID 2376 wrote to memory of 4760 2376 F1F1.tmp 95 PID 2376 wrote to memory of 4760 2376 F1F1.tmp 95 PID 4760 wrote to memory of 1496 4760 F2BC.tmp 96 PID 4760 wrote to memory of 1496 4760 F2BC.tmp 96 PID 4760 wrote to memory of 1496 4760 F2BC.tmp 96 PID 1496 wrote to memory of 2940 1496 F397.tmp 97 PID 1496 wrote to memory of 2940 1496 F397.tmp 97 PID 1496 wrote to memory of 2940 1496 F397.tmp 97 PID 2940 wrote to memory of 4072 2940 F4A1.tmp 98 PID 2940 wrote to memory of 4072 2940 F4A1.tmp 98 PID 2940 wrote to memory of 4072 2940 F4A1.tmp 98 PID 4072 wrote to memory of 1944 4072 F54D.tmp 99 PID 4072 wrote to memory of 1944 4072 F54D.tmp 99 PID 4072 wrote to memory of 1944 4072 F54D.tmp 99 PID 1944 wrote to memory of 1536 1944 F5F9.tmp 101 PID 1944 wrote to memory of 1536 1944 F5F9.tmp 101 PID 1944 wrote to memory of 1536 1944 F5F9.tmp 101 PID 1536 wrote to memory of 4340 1536 F6A4.tmp 102 PID 1536 wrote to memory of 4340 1536 F6A4.tmp 102 PID 1536 wrote to memory of 4340 1536 F6A4.tmp 102 PID 4340 wrote to memory of 3048 4340 F77F.tmp 103 PID 4340 wrote to memory of 3048 4340 F77F.tmp 103 PID 4340 wrote to memory of 3048 4340 F77F.tmp 103 PID 3048 wrote to memory of 1764 3048 F80C.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\19d441318eed6cfe6d448d25bc23d628_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"C:\Users\Admin\AppData\Local\Temp\F0D8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"C:\Users\Admin\AppData\Local\Temp\F1F1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\F397.tmp"C:\Users\Admin\AppData\Local\Temp\F397.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"C:\Users\Admin\AppData\Local\Temp\F6A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\F77F.tmp"C:\Users\Admin\AppData\Local\Temp\F77F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"23⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"24⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"C:\Users\Admin\AppData\Local\Temp\FAAC.tmp"25⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"26⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"27⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"28⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"29⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"C:\Users\Admin\AppData\Local\Temp\FF4F.tmp"30⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"31⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"32⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"33⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"34⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"35⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3C4.tmp"C:\Users\Admin\AppData\Local\Temp\3C4.tmp"36⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"37⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4BE.tmp"C:\Users\Admin\AppData\Local\Temp\4BE.tmp"38⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"39⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"40⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"41⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"42⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"43⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"44⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\913.tmp"C:\Users\Admin\AppData\Local\Temp\913.tmp"45⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9AF.tmp"C:\Users\Admin\AppData\Local\Temp\9AF.tmp"46⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"47⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"48⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"49⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"50⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"51⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"52⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"53⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"54⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"55⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"56⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"57⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\1085.tmp"C:\Users\Admin\AppData\Local\Temp\1085.tmp"58⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"59⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\119F.tmp"C:\Users\Admin\AppData\Local\Temp\119F.tmp"60⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"61⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"62⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"63⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"64⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"66⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"67⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"68⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"69⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"70⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"71⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"72⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"73⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"74⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"75⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1B43.tmp"C:\Users\Admin\AppData\Local\Temp\1B43.tmp"76⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"77⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"78⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"79⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\1D57.tmp"C:\Users\Admin\AppData\Local\Temp\1D57.tmp"80⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"81⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"82⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"83⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"84⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"85⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\20C2.tmp"C:\Users\Admin\AppData\Local\Temp\20C2.tmp"86⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"87⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"88⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"89⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"90⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"91⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"92⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"93⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"94⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"95⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"96⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"97⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"98⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\28EF.tmp"C:\Users\Admin\AppData\Local\Temp\28EF.tmp"99⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"100⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"101⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"102⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"103⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"104⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"105⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"106⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"107⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"108⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"109⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"110⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"111⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"112⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"113⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"114⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"115⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"116⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"117⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"118⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"119⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"120⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"121⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"122⤵PID:3700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-