Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 09:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe
-
Size
486KB
-
MD5
4d9cd336b4462f4a502b305ec9634d13
-
SHA1
c5a2a000046cb1d94e3ff20c66f03a90c6647b86
-
SHA256
71a28561211707ecbbe6ef91b9e19db8317036b1ecce2784a7bda46233c2f9a5
-
SHA512
8f0a623b774697a1ba76f31fa54b0d641aff9562b50d8492998790176142c130b129c3c6aebd811df4ae22b1e84948cf714d0fcf0f6bb4cd8b65f6403e3ad729
-
SSDEEP
12288:/U5rCOTeiD2D4NIuNu4FDxCWJzU4aD3BEiHfNZ:/UQOJD2yzNJC8aDGwN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1584 88D7.tmp 2384 89B2.tmp 5096 8A7D.tmp 1552 8B67.tmp 2092 8BE4.tmp 620 8C81.tmp 2852 8D1D.tmp 1780 8DD8.tmp 3304 8EC3.tmp 2388 8F30.tmp 1952 900B.tmp 4956 90F5.tmp 2024 91A1.tmp 1028 920E.tmp 1876 929B.tmp 4988 93C4.tmp 1480 9451.tmp 5088 94ED.tmp 3244 9599.tmp 4112 9616.tmp 4428 96F0.tmp 4016 9858.tmp 4256 9942.tmp 2084 99EE.tmp 4712 9AAA.tmp 4692 9B27.tmp 3872 9BB3.tmp 1968 9C6F.tmp 2560 9CFB.tmp 2732 9DA7.tmp 964 9E53.tmp 4624 9F1E.tmp 4716 9FDA.tmp 372 A076.tmp 4628 A103.tmp 5028 A180.tmp 1216 A21C.tmp 3068 A2B8.tmp 2292 A335.tmp 4020 A3D1.tmp 768 A46E.tmp 1348 A4FA.tmp 872 A587.tmp 2040 A633.tmp 4928 A6B0.tmp 860 A74C.tmp 4068 A7C9.tmp 640 A865.tmp 1616 A901.tmp 1608 A97E.tmp 4224 AA1B.tmp 4924 AAA7.tmp 4104 AB34.tmp 4024 ABE0.tmp 1152 AC5D.tmp 64 ACF9.tmp 2144 AD66.tmp 4728 AE03.tmp 4316 AE70.tmp 3340 AEFD.tmp 620 AF89.tmp 4480 B006.tmp 4980 B0A3.tmp 3724 B13F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1584 1600 4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe 83 PID 1600 wrote to memory of 1584 1600 4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe 83 PID 1600 wrote to memory of 1584 1600 4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe 83 PID 1584 wrote to memory of 2384 1584 88D7.tmp 84 PID 1584 wrote to memory of 2384 1584 88D7.tmp 84 PID 1584 wrote to memory of 2384 1584 88D7.tmp 84 PID 2384 wrote to memory of 5096 2384 89B2.tmp 85 PID 2384 wrote to memory of 5096 2384 89B2.tmp 85 PID 2384 wrote to memory of 5096 2384 89B2.tmp 85 PID 5096 wrote to memory of 1552 5096 8A7D.tmp 86 PID 5096 wrote to memory of 1552 5096 8A7D.tmp 86 PID 5096 wrote to memory of 1552 5096 8A7D.tmp 86 PID 1552 wrote to memory of 2092 1552 8B67.tmp 87 PID 1552 wrote to memory of 2092 1552 8B67.tmp 87 PID 1552 wrote to memory of 2092 1552 8B67.tmp 87 PID 2092 wrote to memory of 620 2092 8BE4.tmp 88 PID 2092 wrote to memory of 620 2092 8BE4.tmp 88 PID 2092 wrote to memory of 620 2092 8BE4.tmp 88 PID 620 wrote to memory of 2852 620 8C81.tmp 89 PID 620 wrote to memory of 2852 620 8C81.tmp 89 PID 620 wrote to memory of 2852 620 8C81.tmp 89 PID 2852 wrote to memory of 1780 2852 8D1D.tmp 90 PID 2852 wrote to memory of 1780 2852 8D1D.tmp 90 PID 2852 wrote to memory of 1780 2852 8D1D.tmp 90 PID 1780 wrote to memory of 3304 1780 8DD8.tmp 91 PID 1780 wrote to memory of 3304 1780 8DD8.tmp 91 PID 1780 wrote to memory of 3304 1780 8DD8.tmp 91 PID 3304 wrote to memory of 2388 3304 8EC3.tmp 92 PID 3304 wrote to memory of 2388 3304 8EC3.tmp 92 PID 3304 wrote to memory of 2388 3304 8EC3.tmp 92 PID 2388 wrote to memory of 1952 2388 8F30.tmp 93 PID 2388 wrote to memory of 1952 2388 8F30.tmp 93 PID 2388 wrote to memory of 1952 2388 8F30.tmp 93 PID 1952 wrote to memory of 4956 1952 900B.tmp 94 PID 1952 wrote to memory of 4956 1952 900B.tmp 94 PID 1952 wrote to memory of 4956 1952 900B.tmp 94 PID 4956 wrote to memory of 2024 4956 90F5.tmp 95 PID 4956 wrote to memory of 2024 4956 90F5.tmp 95 PID 4956 wrote to memory of 2024 4956 90F5.tmp 95 PID 2024 wrote to memory of 1028 2024 91A1.tmp 96 PID 2024 wrote to memory of 1028 2024 91A1.tmp 96 PID 2024 wrote to memory of 1028 2024 91A1.tmp 96 PID 1028 wrote to memory of 1876 1028 920E.tmp 97 PID 1028 wrote to memory of 1876 1028 920E.tmp 97 PID 1028 wrote to memory of 1876 1028 920E.tmp 97 PID 1876 wrote to memory of 4988 1876 929B.tmp 98 PID 1876 wrote to memory of 4988 1876 929B.tmp 98 PID 1876 wrote to memory of 4988 1876 929B.tmp 98 PID 4988 wrote to memory of 1480 4988 93C4.tmp 99 PID 4988 wrote to memory of 1480 4988 93C4.tmp 99 PID 4988 wrote to memory of 1480 4988 93C4.tmp 99 PID 1480 wrote to memory of 5088 1480 9451.tmp 100 PID 1480 wrote to memory of 5088 1480 9451.tmp 100 PID 1480 wrote to memory of 5088 1480 9451.tmp 100 PID 5088 wrote to memory of 3244 5088 94ED.tmp 101 PID 5088 wrote to memory of 3244 5088 94ED.tmp 101 PID 5088 wrote to memory of 3244 5088 94ED.tmp 101 PID 3244 wrote to memory of 4112 3244 9599.tmp 104 PID 3244 wrote to memory of 4112 3244 9599.tmp 104 PID 3244 wrote to memory of 4112 3244 9599.tmp 104 PID 4112 wrote to memory of 4428 4112 9616.tmp 105 PID 4112 wrote to memory of 4428 4112 9616.tmp 105 PID 4112 wrote to memory of 4428 4112 9616.tmp 105 PID 4428 wrote to memory of 4016 4428 96F0.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\4d9cd336b4462f4a502b305ec9634d13_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"23⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"24⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"25⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"26⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"27⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"28⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"29⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"30⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"31⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"32⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"33⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"34⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"35⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"36⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"37⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"38⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"39⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"40⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"41⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"42⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"43⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"44⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"45⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"46⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"47⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"48⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"49⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"50⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"51⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"52⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"54⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"55⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"56⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"57⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"58⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"59⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"60⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"61⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"62⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"63⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"64⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"65⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"66⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"67⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"68⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"69⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"70⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"71⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"72⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"73⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"74⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"75⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"76⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"77⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"78⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"79⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"80⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"81⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"82⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"83⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"84⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"85⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"86⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"87⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"88⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"89⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"90⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"91⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"92⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"93⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"94⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"95⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"96⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"97⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"98⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"99⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"100⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"101⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"102⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"103⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"104⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"105⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"106⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"107⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"108⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"109⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"110⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"111⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"112⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"113⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"114⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"115⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"116⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"117⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"118⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"119⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"120⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"121⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-