Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe
-
Size
488KB
-
MD5
1faa3622c18d0cb13f79cd16cd411d53
-
SHA1
9e76bc7d2b7470dbaf3bc7f0e9f51e83e908581d
-
SHA256
2b90b10a53e25fedc940af08aaed0817f10aa270cf88a87735de144d4b09040b
-
SHA512
6faf1b913e87710c312aba2fe4467f26398c75fa7facec78d1c70dea79fec8b543ea94e60a779c788dd29e708de677ec9b9742b87dee1fb8e5f890a04d1a5120
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7YSzoQm29mq235b0PAjWxpyxv3FLKc3N1Ci0O:/U5rCOTeiDpm2p250IjHXu8H/0MdNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2264 829D.tmp 1536 8349.tmp 1304 8424.tmp 2464 850E.tmp 3716 85E9.tmp 3784 8685.tmp 4960 8702.tmp 1000 87DD.tmp 1676 8889.tmp 1728 8954.tmp 2276 89F0.tmp 1232 8AAC.tmp 3872 8B58.tmp 1944 8C04.tmp 4656 8D2C.tmp 4684 8DB9.tmp 1296 8E55.tmp 3332 8F01.tmp 2556 8FDC.tmp 3688 90B7.tmp 2220 91A1.tmp 1076 928B.tmp 3456 9337.tmp 392 93C4.tmp 2076 9470.tmp 4984 954B.tmp 1136 95C8.tmp 4252 9673.tmp 1012 973F.tmp 3744 9819.tmp 4256 98D5.tmp 3840 99CF.tmp 5072 9A9A.tmp 4996 9B17.tmp 536 9BA4.tmp 2588 9C40.tmp 1020 9EC0.tmp 1792 9F5D.tmp 1460 9FF9.tmp 1880 A086.tmp 416 A122.tmp 4812 A1AE.tmp 4908 A25A.tmp 4432 A2F7.tmp 3080 A374.tmp 4424 A41F.tmp 4660 A4BC.tmp 3360 A568.tmp 1956 A5E5.tmp 748 A671.tmp 1400 A71D.tmp 2268 A7AA.tmp 4480 A817.tmp 4488 A8C3.tmp 4732 A940.tmp 3552 A9EC.tmp 4960 AA88.tmp 2940 AB24.tmp 2516 ABC1.tmp 2732 AC2E.tmp 1132 ACAB.tmp 3136 AD28.tmp 1232 AD86.tmp 4244 AE03.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3892 wrote to memory of 2264 3892 1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe 82 PID 3892 wrote to memory of 2264 3892 1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe 82 PID 3892 wrote to memory of 2264 3892 1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe 82 PID 2264 wrote to memory of 1536 2264 829D.tmp 83 PID 2264 wrote to memory of 1536 2264 829D.tmp 83 PID 2264 wrote to memory of 1536 2264 829D.tmp 83 PID 1536 wrote to memory of 1304 1536 8349.tmp 84 PID 1536 wrote to memory of 1304 1536 8349.tmp 84 PID 1536 wrote to memory of 1304 1536 8349.tmp 84 PID 1304 wrote to memory of 2464 1304 8424.tmp 85 PID 1304 wrote to memory of 2464 1304 8424.tmp 85 PID 1304 wrote to memory of 2464 1304 8424.tmp 85 PID 2464 wrote to memory of 3716 2464 850E.tmp 86 PID 2464 wrote to memory of 3716 2464 850E.tmp 86 PID 2464 wrote to memory of 3716 2464 850E.tmp 86 PID 3716 wrote to memory of 3784 3716 85E9.tmp 87 PID 3716 wrote to memory of 3784 3716 85E9.tmp 87 PID 3716 wrote to memory of 3784 3716 85E9.tmp 87 PID 3784 wrote to memory of 4960 3784 8685.tmp 88 PID 3784 wrote to memory of 4960 3784 8685.tmp 88 PID 3784 wrote to memory of 4960 3784 8685.tmp 88 PID 4960 wrote to memory of 1000 4960 8702.tmp 89 PID 4960 wrote to memory of 1000 4960 8702.tmp 89 PID 4960 wrote to memory of 1000 4960 8702.tmp 89 PID 1000 wrote to memory of 1676 1000 87DD.tmp 90 PID 1000 wrote to memory of 1676 1000 87DD.tmp 90 PID 1000 wrote to memory of 1676 1000 87DD.tmp 90 PID 1676 wrote to memory of 1728 1676 8889.tmp 91 PID 1676 wrote to memory of 1728 1676 8889.tmp 91 PID 1676 wrote to memory of 1728 1676 8889.tmp 91 PID 1728 wrote to memory of 2276 1728 8954.tmp 93 PID 1728 wrote to memory of 2276 1728 8954.tmp 93 PID 1728 wrote to memory of 2276 1728 8954.tmp 93 PID 2276 wrote to memory of 1232 2276 89F0.tmp 94 PID 2276 wrote to memory of 1232 2276 89F0.tmp 94 PID 2276 wrote to memory of 1232 2276 89F0.tmp 94 PID 1232 wrote to memory of 3872 1232 8AAC.tmp 95 PID 1232 wrote to memory of 3872 1232 8AAC.tmp 95 PID 1232 wrote to memory of 3872 1232 8AAC.tmp 95 PID 3872 wrote to memory of 1944 3872 8B58.tmp 96 PID 3872 wrote to memory of 1944 3872 8B58.tmp 96 PID 3872 wrote to memory of 1944 3872 8B58.tmp 96 PID 1944 wrote to memory of 4656 1944 8C04.tmp 97 PID 1944 wrote to memory of 4656 1944 8C04.tmp 97 PID 1944 wrote to memory of 4656 1944 8C04.tmp 97 PID 4656 wrote to memory of 4684 4656 8D2C.tmp 98 PID 4656 wrote to memory of 4684 4656 8D2C.tmp 98 PID 4656 wrote to memory of 4684 4656 8D2C.tmp 98 PID 4684 wrote to memory of 1296 4684 8DB9.tmp 99 PID 4684 wrote to memory of 1296 4684 8DB9.tmp 99 PID 4684 wrote to memory of 1296 4684 8DB9.tmp 99 PID 1296 wrote to memory of 3332 1296 8E55.tmp 100 PID 1296 wrote to memory of 3332 1296 8E55.tmp 100 PID 1296 wrote to memory of 3332 1296 8E55.tmp 100 PID 3332 wrote to memory of 2556 3332 8F01.tmp 103 PID 3332 wrote to memory of 2556 3332 8F01.tmp 103 PID 3332 wrote to memory of 2556 3332 8F01.tmp 103 PID 2556 wrote to memory of 3688 2556 8FDC.tmp 104 PID 2556 wrote to memory of 3688 2556 8FDC.tmp 104 PID 2556 wrote to memory of 3688 2556 8FDC.tmp 104 PID 3688 wrote to memory of 2220 3688 90B7.tmp 105 PID 3688 wrote to memory of 2220 3688 90B7.tmp 105 PID 3688 wrote to memory of 2220 3688 90B7.tmp 105 PID 2220 wrote to memory of 1076 2220 91A1.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1faa3622c18d0cb13f79cd16cd411d53_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"23⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"24⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"25⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"26⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"27⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"28⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"29⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"30⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"31⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"32⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"33⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"34⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"35⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"36⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"37⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"38⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"39⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"40⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"41⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"42⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"43⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"44⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"45⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"46⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"47⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"48⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"49⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"50⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"51⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"52⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"53⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"54⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"55⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"56⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"57⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"58⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"59⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"60⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"61⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"62⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"63⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"64⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"65⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"66⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"67⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"68⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"71⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"72⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"73⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"74⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"75⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"76⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"77⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"78⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"79⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"80⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"81⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"82⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"83⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"84⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"85⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"86⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"87⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"88⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"89⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"90⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"91⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"92⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"93⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"94⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"95⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"96⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"97⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"98⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"99⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"100⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"101⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"102⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"103⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"104⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"105⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"106⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"107⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"108⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"109⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"111⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"112⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"113⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"114⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"115⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"116⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"117⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"118⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"119⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"120⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"121⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-