Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4692b3580fc904db67c931cddddbb19d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4692b3580fc904db67c931cddddbb19d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4692b3580fc904db67c931cddddbb19d_mafia_JC.exe
-
Size
520KB
-
MD5
4692b3580fc904db67c931cddddbb19d
-
SHA1
953fb977424c333bc55c3c0575d295ab399d0b05
-
SHA256
6172d373d533fa954393d9d101ebacb4f48d62e3bc0e4161a78767d3e85b4b68
-
SHA512
fc509959deca3ca720871611b7d89a9ed78b5ef95be09176a8ed0a15567aac1aae0b8792384c2e33d9b2586b73dcb2877bf4d51764c2a905ccf4cf7f0fed6a26
-
SSDEEP
12288:roRXOQjmOyM7qe9Qb+0R83tGrzqIidMiIHxUeD8NZ:rogQ9yM7p0dOdCqIioRUlN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4716 7BA8.tmp 3584 7C92.tmp 1704 7D5E.tmp 3604 7E96.tmp 4592 7F52.tmp 3740 802C.tmp 2092 80B9.tmp 3128 8146.tmp 3832 8201.tmp 488 82AD.tmp 1372 8405.tmp 4672 850E.tmp 2788 85E9.tmp 3592 86A5.tmp 4880 8770.tmp 2948 884A.tmp 4020 88D7.tmp 4232 8A00.tmp 1040 8ABB.tmp 60 8B77.tmp 4652 8C42.tmp 1368 8D0D.tmp 1956 8DD8.tmp 1604 8E75.tmp 1872 8F40.tmp 2436 900B.tmp 4352 9114.tmp 4556 91D0.tmp 5076 925D.tmp 3824 9337.tmp 3220 93D4.tmp 4916 94AE.tmp 5096 956A.tmp 4804 9606.tmp 4256 9683.tmp 2564 972F.tmp 4692 979C.tmp 1996 9848.tmp 4304 98E4.tmp 116 9981.tmp 3940 9A1D.tmp 1196 9AC9.tmp 3684 9B36.tmp 3180 9BC3.tmp 908 9C6F.tmp 4864 9CFB.tmp 4524 9D88.tmp 4576 9E34.tmp 2176 9EC0.tmp 4996 9F5D.tmp 3704 A009.tmp 2780 A0A5.tmp 848 A122.tmp 3668 A1AE.tmp 3556 A23B.tmp 3304 A2C8.tmp 548 A354.tmp 3044 A3F1.tmp 2672 A48D.tmp 1136 A4FA.tmp 856 A577.tmp 2076 A5E5.tmp 3192 A671.tmp 2820 A6EE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 4716 2552 4692b3580fc904db67c931cddddbb19d_mafia_JC.exe 83 PID 2552 wrote to memory of 4716 2552 4692b3580fc904db67c931cddddbb19d_mafia_JC.exe 83 PID 2552 wrote to memory of 4716 2552 4692b3580fc904db67c931cddddbb19d_mafia_JC.exe 83 PID 4716 wrote to memory of 3584 4716 7BA8.tmp 84 PID 4716 wrote to memory of 3584 4716 7BA8.tmp 84 PID 4716 wrote to memory of 3584 4716 7BA8.tmp 84 PID 3584 wrote to memory of 1704 3584 7C92.tmp 85 PID 3584 wrote to memory of 1704 3584 7C92.tmp 85 PID 3584 wrote to memory of 1704 3584 7C92.tmp 85 PID 1704 wrote to memory of 3604 1704 7D5E.tmp 86 PID 1704 wrote to memory of 3604 1704 7D5E.tmp 86 PID 1704 wrote to memory of 3604 1704 7D5E.tmp 86 PID 3604 wrote to memory of 4592 3604 7E96.tmp 87 PID 3604 wrote to memory of 4592 3604 7E96.tmp 87 PID 3604 wrote to memory of 4592 3604 7E96.tmp 87 PID 4592 wrote to memory of 3740 4592 7F52.tmp 88 PID 4592 wrote to memory of 3740 4592 7F52.tmp 88 PID 4592 wrote to memory of 3740 4592 7F52.tmp 88 PID 3740 wrote to memory of 2092 3740 802C.tmp 89 PID 3740 wrote to memory of 2092 3740 802C.tmp 89 PID 3740 wrote to memory of 2092 3740 802C.tmp 89 PID 2092 wrote to memory of 3128 2092 80B9.tmp 91 PID 2092 wrote to memory of 3128 2092 80B9.tmp 91 PID 2092 wrote to memory of 3128 2092 80B9.tmp 91 PID 3128 wrote to memory of 3832 3128 8146.tmp 92 PID 3128 wrote to memory of 3832 3128 8146.tmp 92 PID 3128 wrote to memory of 3832 3128 8146.tmp 92 PID 3832 wrote to memory of 488 3832 8201.tmp 93 PID 3832 wrote to memory of 488 3832 8201.tmp 93 PID 3832 wrote to memory of 488 3832 8201.tmp 93 PID 488 wrote to memory of 1372 488 82AD.tmp 94 PID 488 wrote to memory of 1372 488 82AD.tmp 94 PID 488 wrote to memory of 1372 488 82AD.tmp 94 PID 1372 wrote to memory of 4672 1372 8405.tmp 95 PID 1372 wrote to memory of 4672 1372 8405.tmp 95 PID 1372 wrote to memory of 4672 1372 8405.tmp 95 PID 4672 wrote to memory of 2788 4672 850E.tmp 96 PID 4672 wrote to memory of 2788 4672 850E.tmp 96 PID 4672 wrote to memory of 2788 4672 850E.tmp 96 PID 2788 wrote to memory of 3592 2788 85E9.tmp 97 PID 2788 wrote to memory of 3592 2788 85E9.tmp 97 PID 2788 wrote to memory of 3592 2788 85E9.tmp 97 PID 3592 wrote to memory of 4880 3592 86A5.tmp 98 PID 3592 wrote to memory of 4880 3592 86A5.tmp 98 PID 3592 wrote to memory of 4880 3592 86A5.tmp 98 PID 4880 wrote to memory of 2948 4880 8770.tmp 101 PID 4880 wrote to memory of 2948 4880 8770.tmp 101 PID 4880 wrote to memory of 2948 4880 8770.tmp 101 PID 2948 wrote to memory of 4020 2948 884A.tmp 102 PID 2948 wrote to memory of 4020 2948 884A.tmp 102 PID 2948 wrote to memory of 4020 2948 884A.tmp 102 PID 4020 wrote to memory of 4232 4020 88D7.tmp 103 PID 4020 wrote to memory of 4232 4020 88D7.tmp 103 PID 4020 wrote to memory of 4232 4020 88D7.tmp 103 PID 4232 wrote to memory of 1040 4232 8A00.tmp 104 PID 4232 wrote to memory of 1040 4232 8A00.tmp 104 PID 4232 wrote to memory of 1040 4232 8A00.tmp 104 PID 1040 wrote to memory of 60 1040 8ABB.tmp 105 PID 1040 wrote to memory of 60 1040 8ABB.tmp 105 PID 1040 wrote to memory of 60 1040 8ABB.tmp 105 PID 60 wrote to memory of 4652 60 8B77.tmp 106 PID 60 wrote to memory of 4652 60 8B77.tmp 106 PID 60 wrote to memory of 4652 60 8B77.tmp 106 PID 4652 wrote to memory of 1368 4652 8C42.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\4692b3580fc904db67c931cddddbb19d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4692b3580fc904db67c931cddddbb19d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"23⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"24⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"25⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"26⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"27⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"28⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"29⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"30⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"31⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"32⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"33⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"34⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"35⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"36⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"37⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"38⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"39⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"40⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"41⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"42⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"43⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"44⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"45⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"46⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"47⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"48⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"49⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"50⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"51⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"52⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"53⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"54⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"55⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\A23B.tmp"C:\Users\Admin\AppData\Local\Temp\A23B.tmp"56⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"57⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"58⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"59⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"60⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"61⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"62⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"63⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"64⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"65⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"66⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"67⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"68⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"69⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"70⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"71⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"72⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"73⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"74⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"75⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"76⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"77⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"78⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"79⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"80⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"81⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"82⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"83⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"84⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"85⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"86⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"87⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"88⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"89⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"90⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"91⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"92⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"93⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"94⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"95⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"96⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"97⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"98⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"99⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"100⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"101⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"102⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"103⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"104⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"105⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"106⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"107⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"108⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"109⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"110⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"111⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"112⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"113⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"114⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"115⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"116⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"117⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"118⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"119⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"120⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"121⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"122⤵PID:3832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-