Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe
-
Size
520KB
-
MD5
4b4ff2e54d323f723170a26785bd1e47
-
SHA1
6cd4c0f0c9fae68d8977341cd970708df6207598
-
SHA256
01f63b44da8a0dfee6a693de873e27da6cd8d3c255733af683a4b27c0550fbe0
-
SHA512
8437b9a0a1f204a8529399abc22b7f9a29561605cba5951a5b8b31824e64e7c0f9e6d6d01dbf68ee996c52be17f15843a178a175c77fb6650d122947c3f0094c
-
SSDEEP
12288:YcRnG07aWikYKNmEAhDVcdP6cuvXxPfm+WpNZ:YcI0BikYKFAyGPM+WpN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2012 8165.tmp 2208 8240.tmp 4360 82DC.tmp 1496 83D6.tmp 4144 84A1.tmp 4936 855C.tmp 960 8608.tmp 976 8702.tmp 5020 878F.tmp 2664 884A.tmp 1148 8916.tmp 4796 8993.tmp 3872 8A4E.tmp 1176 8B38.tmp 64 8BF4.tmp 3944 8C90.tmp 576 8D6B.tmp 2304 8E46.tmp 1368 8EE2.tmp 4176 8FFB.tmp 3004 90A7.tmp 5084 91B1.tmp 4436 92AB.tmp 1948 9347.tmp 4632 9412.tmp 3132 948F.tmp 2316 954B.tmp 1092 95E7.tmp 776 9683.tmp 1396 9710.tmp 920 97CB.tmp 2592 9887.tmp 5076 9942.tmp 4924 99BF.tmp 3156 9A7B.tmp 484 9B46.tmp 3712 9BC3.tmp 4264 9C40.tmp 3236 9CBD.tmp 3136 9D69.tmp 4896 9E15.tmp 2076 9E92.tmp 488 9F1E.tmp 4260 9FDA.tmp 604 A057.tmp 1968 A0D4.tmp 3048 A141.tmp 4500 A1BE.tmp 3684 A24B.tmp 2164 A2E7.tmp 2896 A364.tmp 1496 A410.tmp 4904 A49C.tmp 4840 A539.tmp 2536 A5F4.tmp 4792 A690.tmp 4968 A72D.tmp 976 A7D9.tmp 876 A875.tmp 2376 A8F2.tmp 3696 A96F.tmp 1008 A9FB.tmp 3536 AA88.tmp 4316 AB34.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 2012 4712 4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe 82 PID 4712 wrote to memory of 2012 4712 4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe 82 PID 4712 wrote to memory of 2012 4712 4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe 82 PID 2012 wrote to memory of 2208 2012 8165.tmp 83 PID 2012 wrote to memory of 2208 2012 8165.tmp 83 PID 2012 wrote to memory of 2208 2012 8165.tmp 83 PID 2208 wrote to memory of 4360 2208 8240.tmp 84 PID 2208 wrote to memory of 4360 2208 8240.tmp 84 PID 2208 wrote to memory of 4360 2208 8240.tmp 84 PID 4360 wrote to memory of 1496 4360 82DC.tmp 85 PID 4360 wrote to memory of 1496 4360 82DC.tmp 85 PID 4360 wrote to memory of 1496 4360 82DC.tmp 85 PID 1496 wrote to memory of 4144 1496 83D6.tmp 86 PID 1496 wrote to memory of 4144 1496 83D6.tmp 86 PID 1496 wrote to memory of 4144 1496 83D6.tmp 86 PID 4144 wrote to memory of 4936 4144 84A1.tmp 87 PID 4144 wrote to memory of 4936 4144 84A1.tmp 87 PID 4144 wrote to memory of 4936 4144 84A1.tmp 87 PID 4936 wrote to memory of 960 4936 855C.tmp 88 PID 4936 wrote to memory of 960 4936 855C.tmp 88 PID 4936 wrote to memory of 960 4936 855C.tmp 88 PID 960 wrote to memory of 976 960 8608.tmp 89 PID 960 wrote to memory of 976 960 8608.tmp 89 PID 960 wrote to memory of 976 960 8608.tmp 89 PID 976 wrote to memory of 5020 976 8702.tmp 90 PID 976 wrote to memory of 5020 976 8702.tmp 90 PID 976 wrote to memory of 5020 976 8702.tmp 90 PID 5020 wrote to memory of 2664 5020 878F.tmp 91 PID 5020 wrote to memory of 2664 5020 878F.tmp 91 PID 5020 wrote to memory of 2664 5020 878F.tmp 91 PID 2664 wrote to memory of 1148 2664 884A.tmp 93 PID 2664 wrote to memory of 1148 2664 884A.tmp 93 PID 2664 wrote to memory of 1148 2664 884A.tmp 93 PID 1148 wrote to memory of 4796 1148 8916.tmp 94 PID 1148 wrote to memory of 4796 1148 8916.tmp 94 PID 1148 wrote to memory of 4796 1148 8916.tmp 94 PID 4796 wrote to memory of 3872 4796 8993.tmp 95 PID 4796 wrote to memory of 3872 4796 8993.tmp 95 PID 4796 wrote to memory of 3872 4796 8993.tmp 95 PID 3872 wrote to memory of 1176 3872 8A4E.tmp 96 PID 3872 wrote to memory of 1176 3872 8A4E.tmp 96 PID 3872 wrote to memory of 1176 3872 8A4E.tmp 96 PID 1176 wrote to memory of 64 1176 8B38.tmp 97 PID 1176 wrote to memory of 64 1176 8B38.tmp 97 PID 1176 wrote to memory of 64 1176 8B38.tmp 97 PID 64 wrote to memory of 3944 64 8BF4.tmp 98 PID 64 wrote to memory of 3944 64 8BF4.tmp 98 PID 64 wrote to memory of 3944 64 8BF4.tmp 98 PID 3944 wrote to memory of 576 3944 8C90.tmp 99 PID 3944 wrote to memory of 576 3944 8C90.tmp 99 PID 3944 wrote to memory of 576 3944 8C90.tmp 99 PID 576 wrote to memory of 2304 576 8D6B.tmp 100 PID 576 wrote to memory of 2304 576 8D6B.tmp 100 PID 576 wrote to memory of 2304 576 8D6B.tmp 100 PID 2304 wrote to memory of 1368 2304 8E46.tmp 101 PID 2304 wrote to memory of 1368 2304 8E46.tmp 101 PID 2304 wrote to memory of 1368 2304 8E46.tmp 101 PID 1368 wrote to memory of 4176 1368 8EE2.tmp 104 PID 1368 wrote to memory of 4176 1368 8EE2.tmp 104 PID 1368 wrote to memory of 4176 1368 8EE2.tmp 104 PID 4176 wrote to memory of 3004 4176 8FFB.tmp 105 PID 4176 wrote to memory of 3004 4176 8FFB.tmp 105 PID 4176 wrote to memory of 3004 4176 8FFB.tmp 105 PID 3004 wrote to memory of 5084 3004 90A7.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4b4ff2e54d323f723170a26785bd1e47_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"23⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"24⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"25⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"26⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"27⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"28⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"29⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"30⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"31⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"32⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"33⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"34⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"35⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"36⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"37⤵
- Executes dropped EXE
PID:484 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"38⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"39⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"40⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"41⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"42⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"43⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"44⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"45⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"46⤵
- Executes dropped EXE
PID:604 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"47⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"48⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"49⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"50⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"51⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"52⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"53⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"54⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"55⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"56⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"57⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"58⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"59⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"60⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"61⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"62⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"63⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"64⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"65⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"66⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"67⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"68⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"69⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"70⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"71⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"72⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"73⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"74⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"75⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"76⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"77⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"78⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"79⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"80⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"81⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"82⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"83⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"84⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"85⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"86⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"87⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"88⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"89⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"90⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"91⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"92⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"93⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"94⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"95⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"96⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"97⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"98⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"99⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"100⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"101⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"102⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"103⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"104⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"105⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"106⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"107⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"108⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"109⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"110⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"111⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"112⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"113⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"114⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"115⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"116⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"117⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"118⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"119⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"120⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"121⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"122⤵PID:3820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-