Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe
-
Size
486KB
-
MD5
502ba40f357402e9a9f9a8001a768b2c
-
SHA1
66a3470bbd377888aaf20c6a1ec71b20a732258b
-
SHA256
2204d0c889e1e5d551b8129ac072d62e6fd5b3873ec53fc14894aa86d017b8e8
-
SHA512
fc3618acfc63dd541bd36212b79d3885714b1eb7d531377dd226e6de49efc1388b7ce8948f811de7e4d074f92c74bcc81a401cc3aadda675629b9a23a4bfafac
-
SSDEEP
12288:/U5rCOTeiDhkcGr9V+iMWM7YY90enIopNZ:/UQOJDbGBV+iW7BpN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 668 6DBE.tmp 3460 6E98.tmp 748 6F44.tmp 1196 700F.tmp 3928 7109.tmp 2820 71D4.tmp 5016 7261.tmp 3880 732C.tmp 2260 73D8.tmp 2120 7474.tmp 4808 756E.tmp 4272 7659.tmp 3808 7714.tmp 3188 77D0.tmp 3520 785C.tmp 5028 7918.tmp 1092 79B4.tmp 2720 7A50.tmp 1004 7B98.tmp 3860 7C64.tmp 1532 7D4E.tmp 4876 7DFA.tmp 4236 7EF4.tmp 4516 7FBF.tmp 1800 807A.tmp 4712 8155.tmp 4288 824F.tmp 4904 82CC.tmp 3708 8388.tmp 5024 8443.tmp 4144 850E.tmp 4472 85E9.tmp 2044 86C4.tmp 5052 8760.tmp 2804 87FC.tmp 1364 88A8.tmp 1036 8954.tmp 4072 89C1.tmp 396 8A6D.tmp 1868 8B0A.tmp 940 8B87.tmp 2100 8C13.tmp 1488 8CA0.tmp 4380 8D2C.tmp 988 8DA9.tmp 1256 8E46.tmp 5096 8EE2.tmp 2788 8F7E.tmp 3148 8FEC.tmp 1940 9088.tmp 3548 9134.tmp 1360 925D.tmp 668 92F9.tmp 2532 9376.tmp 216 93F3.tmp 912 948F.tmp 1196 9635.tmp 4960 96A2.tmp 4648 9710.tmp 1164 978D.tmp 3864 97EA.tmp 3804 9858.tmp 2192 98D5.tmp 4620 9952.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 668 3296 502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe 81 PID 3296 wrote to memory of 668 3296 502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe 81 PID 3296 wrote to memory of 668 3296 502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe 81 PID 668 wrote to memory of 3460 668 6DBE.tmp 82 PID 668 wrote to memory of 3460 668 6DBE.tmp 82 PID 668 wrote to memory of 3460 668 6DBE.tmp 82 PID 3460 wrote to memory of 748 3460 6E98.tmp 83 PID 3460 wrote to memory of 748 3460 6E98.tmp 83 PID 3460 wrote to memory of 748 3460 6E98.tmp 83 PID 748 wrote to memory of 1196 748 6F44.tmp 84 PID 748 wrote to memory of 1196 748 6F44.tmp 84 PID 748 wrote to memory of 1196 748 6F44.tmp 84 PID 1196 wrote to memory of 3928 1196 700F.tmp 85 PID 1196 wrote to memory of 3928 1196 700F.tmp 85 PID 1196 wrote to memory of 3928 1196 700F.tmp 85 PID 3928 wrote to memory of 2820 3928 7109.tmp 86 PID 3928 wrote to memory of 2820 3928 7109.tmp 86 PID 3928 wrote to memory of 2820 3928 7109.tmp 86 PID 2820 wrote to memory of 5016 2820 71D4.tmp 87 PID 2820 wrote to memory of 5016 2820 71D4.tmp 87 PID 2820 wrote to memory of 5016 2820 71D4.tmp 87 PID 5016 wrote to memory of 3880 5016 7261.tmp 88 PID 5016 wrote to memory of 3880 5016 7261.tmp 88 PID 5016 wrote to memory of 3880 5016 7261.tmp 88 PID 3880 wrote to memory of 2260 3880 732C.tmp 89 PID 3880 wrote to memory of 2260 3880 732C.tmp 89 PID 3880 wrote to memory of 2260 3880 732C.tmp 89 PID 2260 wrote to memory of 2120 2260 73D8.tmp 90 PID 2260 wrote to memory of 2120 2260 73D8.tmp 90 PID 2260 wrote to memory of 2120 2260 73D8.tmp 90 PID 2120 wrote to memory of 4808 2120 7474.tmp 91 PID 2120 wrote to memory of 4808 2120 7474.tmp 91 PID 2120 wrote to memory of 4808 2120 7474.tmp 91 PID 4808 wrote to memory of 4272 4808 756E.tmp 92 PID 4808 wrote to memory of 4272 4808 756E.tmp 92 PID 4808 wrote to memory of 4272 4808 756E.tmp 92 PID 4272 wrote to memory of 3808 4272 7659.tmp 93 PID 4272 wrote to memory of 3808 4272 7659.tmp 93 PID 4272 wrote to memory of 3808 4272 7659.tmp 93 PID 3808 wrote to memory of 3188 3808 7714.tmp 94 PID 3808 wrote to memory of 3188 3808 7714.tmp 94 PID 3808 wrote to memory of 3188 3808 7714.tmp 94 PID 3188 wrote to memory of 3520 3188 77D0.tmp 95 PID 3188 wrote to memory of 3520 3188 77D0.tmp 95 PID 3188 wrote to memory of 3520 3188 77D0.tmp 95 PID 3520 wrote to memory of 5028 3520 785C.tmp 98 PID 3520 wrote to memory of 5028 3520 785C.tmp 98 PID 3520 wrote to memory of 5028 3520 785C.tmp 98 PID 5028 wrote to memory of 1092 5028 7918.tmp 99 PID 5028 wrote to memory of 1092 5028 7918.tmp 99 PID 5028 wrote to memory of 1092 5028 7918.tmp 99 PID 1092 wrote to memory of 2720 1092 79B4.tmp 100 PID 1092 wrote to memory of 2720 1092 79B4.tmp 100 PID 1092 wrote to memory of 2720 1092 79B4.tmp 100 PID 2720 wrote to memory of 1004 2720 7A50.tmp 101 PID 2720 wrote to memory of 1004 2720 7A50.tmp 101 PID 2720 wrote to memory of 1004 2720 7A50.tmp 101 PID 1004 wrote to memory of 3860 1004 7B98.tmp 102 PID 1004 wrote to memory of 3860 1004 7B98.tmp 102 PID 1004 wrote to memory of 3860 1004 7B98.tmp 102 PID 3860 wrote to memory of 1532 3860 7C64.tmp 104 PID 3860 wrote to memory of 1532 3860 7C64.tmp 104 PID 3860 wrote to memory of 1532 3860 7C64.tmp 104 PID 1532 wrote to memory of 4876 1532 7D4E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\502ba40f357402e9a9f9a8001a768b2c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\7B98.tmp"C:\Users\Admin\AppData\Local\Temp\7B98.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"23⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"24⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"25⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"26⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"27⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"28⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"29⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"30⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"31⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"32⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"33⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"34⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"35⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"36⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"37⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"38⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"39⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"40⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"41⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"42⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"43⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"44⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"45⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"46⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"47⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"48⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"49⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"50⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"51⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"52⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"53⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"54⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"55⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"56⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"57⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"58⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"59⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"60⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"61⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"62⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"63⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"64⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"65⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"66⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"67⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"68⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"69⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"70⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"71⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"72⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"73⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"74⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"75⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"76⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"77⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"78⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"79⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"80⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"81⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"82⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"83⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"84⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"85⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"86⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"87⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"88⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"89⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"90⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"91⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"92⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"93⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"94⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"95⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"96⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"97⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"98⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"99⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"100⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"101⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"102⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"103⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"104⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"105⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"106⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"107⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"108⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"109⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"110⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"111⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"112⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"113⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"114⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"115⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"116⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"117⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"118⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"119⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"120⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"121⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"122⤵PID:744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-