Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 13:16
Static task
static1
Behavioral task
behavioral1
Sample
4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe
-
Size
486KB
-
MD5
4001e80292e6638edcd3b3c42c76fa16
-
SHA1
06befd0b7382003093dad6a117cf390cd05885b6
-
SHA256
9ff1d196db9dbfc555bb8ca5ba3ae4ba307c133677bbd7d1892dc734f2ca0f2d
-
SHA512
c4e9e04c52babb5322f0abb91b3bab25231611bf437af56172b20ced1aa347074fff45285e0e5d69b60c15c44ac30adb3ea1abeafc09a0b6b47b8900f4a1757e
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7NZSkyIb6Pp/n1sDrxepTRskZ0xu0eYCF9yGq:UU5rCOTeiDTzQt1fpdTZwu0jCzyxJNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4048 8FEC.tmp 4072 90C6.tmp 1656 91E0.tmp 392 92DA.tmp 216 93B4.tmp 4328 9460.tmp 1308 952B.tmp 4172 95D7.tmp 2880 9683.tmp 2380 9710.tmp 3252 97AC.tmp 4136 9839.tmp 1272 98C5.tmp 1824 9A2D.tmp 1676 9AF8.tmp 3016 9BC3.tmp 3028 9C5F.tmp 2936 9D0B.tmp 4120 9E43.tmp 2592 9F2E.tmp 1260 A018.tmp 316 A0D4.tmp 4064 A180.tmp 4700 A20C.tmp 2568 A2C8.tmp 3972 A335.tmp 2828 A400.tmp 4832 A49C.tmp 1944 A529.tmp 3796 A613.tmp 4652 A6A0.tmp 3712 A7C9.tmp 2908 A8A4.tmp 5104 A940.tmp 5012 A9BD.tmp 1136 AA59.tmp 3416 AAF5.tmp 4432 AB92.tmp 4376 AC0F.tmp 2792 AC8C.tmp 1636 ACF9.tmp 4288 AD95.tmp 3936 AE22.tmp 4436 AEAF.tmp 4176 AF2C.tmp 1300 AFD7.tmp 2012 B064.tmp 4044 B110.tmp 4232 B18D.tmp 3820 B20A.tmp 3232 B297.tmp 1756 B333.tmp 4024 B3CF.tmp 4728 B49A.tmp 3020 B527.tmp 4776 B5A4.tmp 1656 B650.tmp 3208 B6CD.tmp 4492 B74A.tmp 5008 B7D6.tmp 1016 B863.tmp 3764 B8F0.tmp 1044 B97C.tmp 1960 BA09.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 4048 2520 4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe 82 PID 2520 wrote to memory of 4048 2520 4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe 82 PID 2520 wrote to memory of 4048 2520 4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe 82 PID 4048 wrote to memory of 4072 4048 8FEC.tmp 83 PID 4048 wrote to memory of 4072 4048 8FEC.tmp 83 PID 4048 wrote to memory of 4072 4048 8FEC.tmp 83 PID 4072 wrote to memory of 1656 4072 90C6.tmp 84 PID 4072 wrote to memory of 1656 4072 90C6.tmp 84 PID 4072 wrote to memory of 1656 4072 90C6.tmp 84 PID 1656 wrote to memory of 392 1656 91E0.tmp 85 PID 1656 wrote to memory of 392 1656 91E0.tmp 85 PID 1656 wrote to memory of 392 1656 91E0.tmp 85 PID 392 wrote to memory of 216 392 92DA.tmp 86 PID 392 wrote to memory of 216 392 92DA.tmp 86 PID 392 wrote to memory of 216 392 92DA.tmp 86 PID 216 wrote to memory of 4328 216 93B4.tmp 87 PID 216 wrote to memory of 4328 216 93B4.tmp 87 PID 216 wrote to memory of 4328 216 93B4.tmp 87 PID 4328 wrote to memory of 1308 4328 9460.tmp 88 PID 4328 wrote to memory of 1308 4328 9460.tmp 88 PID 4328 wrote to memory of 1308 4328 9460.tmp 88 PID 1308 wrote to memory of 4172 1308 952B.tmp 89 PID 1308 wrote to memory of 4172 1308 952B.tmp 89 PID 1308 wrote to memory of 4172 1308 952B.tmp 89 PID 4172 wrote to memory of 2880 4172 95D7.tmp 90 PID 4172 wrote to memory of 2880 4172 95D7.tmp 90 PID 4172 wrote to memory of 2880 4172 95D7.tmp 90 PID 2880 wrote to memory of 2380 2880 9683.tmp 92 PID 2880 wrote to memory of 2380 2880 9683.tmp 92 PID 2880 wrote to memory of 2380 2880 9683.tmp 92 PID 2380 wrote to memory of 3252 2380 9710.tmp 93 PID 2380 wrote to memory of 3252 2380 9710.tmp 93 PID 2380 wrote to memory of 3252 2380 9710.tmp 93 PID 3252 wrote to memory of 4136 3252 97AC.tmp 94 PID 3252 wrote to memory of 4136 3252 97AC.tmp 94 PID 3252 wrote to memory of 4136 3252 97AC.tmp 94 PID 4136 wrote to memory of 1272 4136 9839.tmp 95 PID 4136 wrote to memory of 1272 4136 9839.tmp 95 PID 4136 wrote to memory of 1272 4136 9839.tmp 95 PID 1272 wrote to memory of 1824 1272 98C5.tmp 96 PID 1272 wrote to memory of 1824 1272 98C5.tmp 96 PID 1272 wrote to memory of 1824 1272 98C5.tmp 96 PID 1824 wrote to memory of 1676 1824 9A2D.tmp 97 PID 1824 wrote to memory of 1676 1824 9A2D.tmp 97 PID 1824 wrote to memory of 1676 1824 9A2D.tmp 97 PID 1676 wrote to memory of 3016 1676 9AF8.tmp 98 PID 1676 wrote to memory of 3016 1676 9AF8.tmp 98 PID 1676 wrote to memory of 3016 1676 9AF8.tmp 98 PID 3016 wrote to memory of 3028 3016 9BC3.tmp 99 PID 3016 wrote to memory of 3028 3016 9BC3.tmp 99 PID 3016 wrote to memory of 3028 3016 9BC3.tmp 99 PID 3028 wrote to memory of 2936 3028 9C5F.tmp 102 PID 3028 wrote to memory of 2936 3028 9C5F.tmp 102 PID 3028 wrote to memory of 2936 3028 9C5F.tmp 102 PID 2936 wrote to memory of 4120 2936 9D0B.tmp 103 PID 2936 wrote to memory of 4120 2936 9D0B.tmp 103 PID 2936 wrote to memory of 4120 2936 9D0B.tmp 103 PID 4120 wrote to memory of 2592 4120 9E43.tmp 104 PID 4120 wrote to memory of 2592 4120 9E43.tmp 104 PID 4120 wrote to memory of 2592 4120 9E43.tmp 104 PID 2592 wrote to memory of 1260 2592 9F2E.tmp 105 PID 2592 wrote to memory of 1260 2592 9F2E.tmp 105 PID 2592 wrote to memory of 1260 2592 9F2E.tmp 105 PID 1260 wrote to memory of 316 1260 A018.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4001e80292e6638edcd3b3c42c76fa16_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"23⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"24⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"25⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"26⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"27⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"28⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"29⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"30⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"31⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"32⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"33⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"34⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"35⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"36⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"37⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"38⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"39⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"40⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"41⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"42⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"43⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"44⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"45⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"46⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"47⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"48⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"49⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"50⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"51⤵
- Executes dropped EXE
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"52⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"53⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"54⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"55⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"56⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"57⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"58⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"59⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"60⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"61⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"62⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"63⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"64⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"65⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"66⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"67⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"68⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"69⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"70⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"71⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"72⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"73⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"74⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"75⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"76⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"77⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"78⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"79⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"80⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"81⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"82⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"83⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"84⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"85⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"86⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"87⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"88⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"89⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"90⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"91⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"92⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"93⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"94⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"95⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"96⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"97⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"98⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"99⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"100⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"101⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"102⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"103⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"104⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"105⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"106⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"107⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"108⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"109⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"C:\Users\Admin\AppData\Local\Temp\D1F6.tmp"110⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"111⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"C:\Users\Admin\AppData\Local\Temp\D2FF.tmp"112⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"113⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"114⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"115⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\D542.tmp"C:\Users\Admin\AppData\Local\Temp\D542.tmp"116⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"117⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"118⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"C:\Users\Admin\AppData\Local\Temp\D6C8.tmp"119⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"120⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"121⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"122⤵PID:3360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-