Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe
-
Size
488KB
-
MD5
1bfd1db55a60788dabb776a0dc95cefa
-
SHA1
182ffa5fcc5bb1645e9199dd192f91865caec6b5
-
SHA256
b133fc6786bfd8b18abccfdd863a0d14994e187c5c2cbc8b4096b8b3909316eb
-
SHA512
09d72b77cc5866a124d7bfa2c7d8e615274ea6376421714519a2cd6672ad2661db607584aa33c5934bc5b0640de1b6bfd2f60b141d63a170659d0bd2d131232b
-
SSDEEP
12288:/U5rCOTeiDXZ0eL00aLWJ5/0JiChtnXmRXOtDNZ:/UQOJD5aexiiEtnXmRetDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 928 7CA2.tmp 1484 7D5E.tmp 4956 7E48.tmp 1888 7F23.tmp 4116 7FDE.tmp 1692 80A9.tmp 3180 8126.tmp 460 8220.tmp 764 82DC.tmp 3704 8368.tmp 1988 8405.tmp 1584 84A1.tmp 3584 853D.tmp 4904 85E9.tmp 2380 8760.tmp 4792 881C.tmp 2504 88C7.tmp 4376 8983.tmp 4432 8A1F.tmp 2576 8ACB.tmp 1092 8B96.tmp 2624 8C71.tmp 1980 8D6B.tmp 4672 8E75.tmp 4372 8F11.tmp 224 8FAD.tmp 1908 9078.tmp 1196 9114.tmp 4392 91E0.tmp 3344 92CA.tmp 2324 9357.tmp 3944 9431.tmp 4252 950C.tmp 4800 9589.tmp 4936 95F6.tmp 4848 9693.tmp 4260 971F.tmp 5092 979C.tmp 2572 980A.tmp 232 9887.tmp 4932 9904.tmp 2628 99B0.tmp 3288 9A2D.tmp 3788 9AB9.tmp 3192 9B36.tmp 3020 9BC3.tmp 3036 9C6F.tmp 440 9D1B.tmp 4552 9DA7.tmp 4448 9E15.tmp 4236 9EA1.tmp 2028 9F4D.tmp 3792 9FE9.tmp 2404 A066.tmp 5116 A0F3.tmp 1320 A180.tmp 1692 A1DD.tmp 3180 A26A.tmp 2164 A2E7.tmp 4540 A354.tmp 3796 A3D1.tmp 3144 A45E.tmp 4180 A4DB.tmp 3648 A558.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3728 wrote to memory of 928 3728 1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe 81 PID 3728 wrote to memory of 928 3728 1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe 81 PID 3728 wrote to memory of 928 3728 1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe 81 PID 928 wrote to memory of 1484 928 7CA2.tmp 82 PID 928 wrote to memory of 1484 928 7CA2.tmp 82 PID 928 wrote to memory of 1484 928 7CA2.tmp 82 PID 1484 wrote to memory of 4956 1484 7D5E.tmp 83 PID 1484 wrote to memory of 4956 1484 7D5E.tmp 83 PID 1484 wrote to memory of 4956 1484 7D5E.tmp 83 PID 4956 wrote to memory of 1888 4956 7E48.tmp 84 PID 4956 wrote to memory of 1888 4956 7E48.tmp 84 PID 4956 wrote to memory of 1888 4956 7E48.tmp 84 PID 1888 wrote to memory of 4116 1888 7F23.tmp 85 PID 1888 wrote to memory of 4116 1888 7F23.tmp 85 PID 1888 wrote to memory of 4116 1888 7F23.tmp 85 PID 4116 wrote to memory of 1692 4116 7FDE.tmp 86 PID 4116 wrote to memory of 1692 4116 7FDE.tmp 86 PID 4116 wrote to memory of 1692 4116 7FDE.tmp 86 PID 1692 wrote to memory of 3180 1692 80A9.tmp 87 PID 1692 wrote to memory of 3180 1692 80A9.tmp 87 PID 1692 wrote to memory of 3180 1692 80A9.tmp 87 PID 3180 wrote to memory of 460 3180 8126.tmp 88 PID 3180 wrote to memory of 460 3180 8126.tmp 88 PID 3180 wrote to memory of 460 3180 8126.tmp 88 PID 460 wrote to memory of 764 460 8220.tmp 89 PID 460 wrote to memory of 764 460 8220.tmp 89 PID 460 wrote to memory of 764 460 8220.tmp 89 PID 764 wrote to memory of 3704 764 82DC.tmp 90 PID 764 wrote to memory of 3704 764 82DC.tmp 90 PID 764 wrote to memory of 3704 764 82DC.tmp 90 PID 3704 wrote to memory of 1988 3704 8368.tmp 92 PID 3704 wrote to memory of 1988 3704 8368.tmp 92 PID 3704 wrote to memory of 1988 3704 8368.tmp 92 PID 1988 wrote to memory of 1584 1988 8405.tmp 93 PID 1988 wrote to memory of 1584 1988 8405.tmp 93 PID 1988 wrote to memory of 1584 1988 8405.tmp 93 PID 1584 wrote to memory of 3584 1584 84A1.tmp 94 PID 1584 wrote to memory of 3584 1584 84A1.tmp 94 PID 1584 wrote to memory of 3584 1584 84A1.tmp 94 PID 3584 wrote to memory of 4904 3584 853D.tmp 95 PID 3584 wrote to memory of 4904 3584 853D.tmp 95 PID 3584 wrote to memory of 4904 3584 853D.tmp 95 PID 4904 wrote to memory of 2380 4904 85E9.tmp 96 PID 4904 wrote to memory of 2380 4904 85E9.tmp 96 PID 4904 wrote to memory of 2380 4904 85E9.tmp 96 PID 2380 wrote to memory of 4792 2380 8760.tmp 97 PID 2380 wrote to memory of 4792 2380 8760.tmp 97 PID 2380 wrote to memory of 4792 2380 8760.tmp 97 PID 4792 wrote to memory of 2504 4792 881C.tmp 98 PID 4792 wrote to memory of 2504 4792 881C.tmp 98 PID 4792 wrote to memory of 2504 4792 881C.tmp 98 PID 2504 wrote to memory of 4376 2504 88C7.tmp 99 PID 2504 wrote to memory of 4376 2504 88C7.tmp 99 PID 2504 wrote to memory of 4376 2504 88C7.tmp 99 PID 4376 wrote to memory of 4432 4376 8983.tmp 100 PID 4376 wrote to memory of 4432 4376 8983.tmp 100 PID 4376 wrote to memory of 4432 4376 8983.tmp 100 PID 4432 wrote to memory of 2576 4432 8A1F.tmp 103 PID 4432 wrote to memory of 2576 4432 8A1F.tmp 103 PID 4432 wrote to memory of 2576 4432 8A1F.tmp 103 PID 2576 wrote to memory of 1092 2576 8ACB.tmp 104 PID 2576 wrote to memory of 1092 2576 8ACB.tmp 104 PID 2576 wrote to memory of 1092 2576 8ACB.tmp 104 PID 1092 wrote to memory of 2624 1092 8B96.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1bfd1db55a60788dabb776a0dc95cefa_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"23⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"24⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"25⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"26⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"27⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"28⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"29⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"30⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"31⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"32⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"33⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"34⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"35⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"36⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"37⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"38⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"39⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"40⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"41⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"42⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"43⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"44⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"45⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"46⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"47⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"48⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"49⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"50⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"51⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"52⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"53⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"54⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"55⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"56⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"57⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"58⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"59⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"60⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"61⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"62⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"63⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"64⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"65⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"66⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"67⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"68⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"69⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"70⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"71⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"72⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"73⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"74⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"75⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"76⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"77⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"78⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"79⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"80⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"81⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"82⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"83⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"84⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"85⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"86⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"87⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"88⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"89⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"90⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"91⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"92⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"93⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"94⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"95⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"97⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"98⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"99⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"100⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"101⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"102⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"103⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"104⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"105⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"106⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"107⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"108⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"109⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"110⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"111⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"112⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"113⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"114⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"115⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"116⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"117⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"118⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"119⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"120⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"121⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"122⤵PID:4556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-