Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 14:41
Static task
static1
Behavioral task
behavioral1
Sample
451e33a21b74491dd883415ad5115321_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
451e33a21b74491dd883415ad5115321_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
451e33a21b74491dd883415ad5115321_mafia_JC.exe
-
Size
486KB
-
MD5
451e33a21b74491dd883415ad5115321
-
SHA1
94b59a8c5360cae07d3c91b730d8090032b4310f
-
SHA256
470f428752a9c1ae37282c31b528c5b4c256008f46bc18745bed1e3f7fb341ef
-
SHA512
4aec050b28ee38193e652a3ae0fc6cdc8f10c17b17c1ffc8d39d0cb4bbed9f162d3b92a40795c24398c96427dbc6a35456512e9c027914f4b63f24e8476b8976
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7SzgHUSne0kndneOHLHeLw64RAjGvRnvdcsHT:UU5rCOTeiDeg0Se0kXrHKD46eRnllNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 404 A642.tmp 1568 A72D.tmp 4160 A7C9.tmp 1020 A8B3.tmp 1228 A95F.tmp 1216 AA0B.tmp 4648 AA98.tmp 1488 AB44.tmp 4476 ABFF.tmp 3384 AC8C.tmp 4516 AD18.tmp 4444 ADB5.tmp 3704 AE41.tmp 2292 AEDD.tmp 3656 AFB8.tmp 1756 B093.tmp 4748 B16E.tmp 1412 B229.tmp 2908 B2E5.tmp 3368 B391.tmp 60 B5A4.tmp 3584 B67F.tmp 3244 B71B.tmp 4468 B7A7.tmp 2200 B873.tmp 2872 B92E.tmp 4368 B9CA.tmp 3612 BA57.tmp 4320 BB03.tmp 5072 BBED.tmp 4336 BCD8.tmp 2032 BD83.tmp 5080 BE3F.tmp 4192 BEDB.tmp 1052 BF58.tmp 2456 BFF4.tmp 4144 C081.tmp 3928 C11D.tmp 1560 C1BA.tmp 2712 C246.tmp 1428 C2F2.tmp 2764 C38E.tmp 3552 C43A.tmp 804 C4E6.tmp 2100 C592.tmp 4408 C61F.tmp 840 C6AB.tmp 1828 C757.tmp 4556 C7D4.tmp 4384 C841.tmp 372 C8BE.tmp 3620 C95B.tmp 400 C9E7.tmp 1960 CA74.tmp 4760 CB01.tmp 5036 CBFB.tmp 4904 CC68.tmp 824 CCD5.tmp 3676 CD43.tmp 756 CDDF.tmp 4052 CE4C.tmp 4496 CEC9.tmp 2276 CF46.tmp 1908 CFC3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2640 wrote to memory of 404 2640 451e33a21b74491dd883415ad5115321_mafia_JC.exe 82 PID 2640 wrote to memory of 404 2640 451e33a21b74491dd883415ad5115321_mafia_JC.exe 82 PID 2640 wrote to memory of 404 2640 451e33a21b74491dd883415ad5115321_mafia_JC.exe 82 PID 404 wrote to memory of 1568 404 A642.tmp 83 PID 404 wrote to memory of 1568 404 A642.tmp 83 PID 404 wrote to memory of 1568 404 A642.tmp 83 PID 1568 wrote to memory of 4160 1568 A72D.tmp 84 PID 1568 wrote to memory of 4160 1568 A72D.tmp 84 PID 1568 wrote to memory of 4160 1568 A72D.tmp 84 PID 4160 wrote to memory of 1020 4160 A7C9.tmp 85 PID 4160 wrote to memory of 1020 4160 A7C9.tmp 85 PID 4160 wrote to memory of 1020 4160 A7C9.tmp 85 PID 1020 wrote to memory of 1228 1020 A8B3.tmp 86 PID 1020 wrote to memory of 1228 1020 A8B3.tmp 86 PID 1020 wrote to memory of 1228 1020 A8B3.tmp 86 PID 1228 wrote to memory of 1216 1228 A95F.tmp 87 PID 1228 wrote to memory of 1216 1228 A95F.tmp 87 PID 1228 wrote to memory of 1216 1228 A95F.tmp 87 PID 1216 wrote to memory of 4648 1216 AA0B.tmp 88 PID 1216 wrote to memory of 4648 1216 AA0B.tmp 88 PID 1216 wrote to memory of 4648 1216 AA0B.tmp 88 PID 4648 wrote to memory of 1488 4648 AA98.tmp 89 PID 4648 wrote to memory of 1488 4648 AA98.tmp 89 PID 4648 wrote to memory of 1488 4648 AA98.tmp 89 PID 1488 wrote to memory of 4476 1488 AB44.tmp 91 PID 1488 wrote to memory of 4476 1488 AB44.tmp 91 PID 1488 wrote to memory of 4476 1488 AB44.tmp 91 PID 4476 wrote to memory of 3384 4476 ABFF.tmp 92 PID 4476 wrote to memory of 3384 4476 ABFF.tmp 92 PID 4476 wrote to memory of 3384 4476 ABFF.tmp 92 PID 3384 wrote to memory of 4516 3384 AC8C.tmp 93 PID 3384 wrote to memory of 4516 3384 AC8C.tmp 93 PID 3384 wrote to memory of 4516 3384 AC8C.tmp 93 PID 4516 wrote to memory of 4444 4516 AD18.tmp 94 PID 4516 wrote to memory of 4444 4516 AD18.tmp 94 PID 4516 wrote to memory of 4444 4516 AD18.tmp 94 PID 4444 wrote to memory of 3704 4444 ADB5.tmp 95 PID 4444 wrote to memory of 3704 4444 ADB5.tmp 95 PID 4444 wrote to memory of 3704 4444 ADB5.tmp 95 PID 3704 wrote to memory of 2292 3704 AE41.tmp 96 PID 3704 wrote to memory of 2292 3704 AE41.tmp 96 PID 3704 wrote to memory of 2292 3704 AE41.tmp 96 PID 2292 wrote to memory of 3656 2292 AEDD.tmp 97 PID 2292 wrote to memory of 3656 2292 AEDD.tmp 97 PID 2292 wrote to memory of 3656 2292 AEDD.tmp 97 PID 3656 wrote to memory of 1756 3656 AFB8.tmp 98 PID 3656 wrote to memory of 1756 3656 AFB8.tmp 98 PID 3656 wrote to memory of 1756 3656 AFB8.tmp 98 PID 1756 wrote to memory of 4748 1756 B093.tmp 99 PID 1756 wrote to memory of 4748 1756 B093.tmp 99 PID 1756 wrote to memory of 4748 1756 B093.tmp 99 PID 4748 wrote to memory of 1412 4748 B16E.tmp 100 PID 4748 wrote to memory of 1412 4748 B16E.tmp 100 PID 4748 wrote to memory of 1412 4748 B16E.tmp 100 PID 1412 wrote to memory of 2908 1412 B229.tmp 103 PID 1412 wrote to memory of 2908 1412 B229.tmp 103 PID 1412 wrote to memory of 2908 1412 B229.tmp 103 PID 2908 wrote to memory of 3368 2908 B2E5.tmp 104 PID 2908 wrote to memory of 3368 2908 B2E5.tmp 104 PID 2908 wrote to memory of 3368 2908 B2E5.tmp 104 PID 3368 wrote to memory of 60 3368 B391.tmp 105 PID 3368 wrote to memory of 60 3368 B391.tmp 105 PID 3368 wrote to memory of 60 3368 B391.tmp 105 PID 60 wrote to memory of 3584 60 B5A4.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\451e33a21b74491dd883415ad5115321_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\451e33a21b74491dd883415ad5115321_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"23⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"24⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"25⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"26⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"27⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"28⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"29⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"30⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"31⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"32⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"33⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"34⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"35⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"36⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"37⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"38⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"39⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"40⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"41⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"42⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"43⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"44⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"45⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"46⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"47⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"48⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"49⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"50⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"51⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"52⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"53⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"54⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"55⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"56⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"57⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"58⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"59⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"60⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"61⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"62⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"63⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"64⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"65⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"66⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"67⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\D12B.tmp"C:\Users\Admin\AppData\Local\Temp\D12B.tmp"68⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"69⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"70⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"71⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"72⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"73⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"74⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"75⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"76⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"77⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\D60D.tmp"C:\Users\Admin\AppData\Local\Temp\D60D.tmp"78⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"79⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"80⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\D810.tmp"C:\Users\Admin\AppData\Local\Temp\D810.tmp"81⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"82⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\D91A.tmp"C:\Users\Admin\AppData\Local\Temp\D91A.tmp"83⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"84⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"85⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"86⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"87⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"88⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"89⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"C:\Users\Admin\AppData\Local\Temp\DE5A.tmp"90⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\DED7.tmp"C:\Users\Admin\AppData\Local\Temp\DED7.tmp"91⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"92⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"93⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"94⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"95⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"C:\Users\Admin\AppData\Local\Temp\E2DE.tmp"96⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"97⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"98⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"99⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"100⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"101⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"103⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"104⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"105⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"106⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"107⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"108⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\EA31.tmp"C:\Users\Admin\AppData\Local\Temp\EA31.tmp"109⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"110⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"111⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"C:\Users\Admin\AppData\Local\Temp\EBE6.tmp"112⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\EC92.tmp"C:\Users\Admin\AppData\Local\Temp\EC92.tmp"113⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"114⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"115⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"116⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\EF71.tmp"C:\Users\Admin\AppData\Local\Temp\EF71.tmp"117⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"118⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"119⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"120⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"121⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\F23F.tmp"C:\Users\Admin\AppData\Local\Temp\F23F.tmp"122⤵PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-