Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
50cb02768e80060a124a9b7482be51b7_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
50cb02768e80060a124a9b7482be51b7_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
50cb02768e80060a124a9b7482be51b7_mafia_JC.exe
-
Size
488KB
-
MD5
50cb02768e80060a124a9b7482be51b7
-
SHA1
8720cb3f7c668122114c7370b9e6054dc0c4e49a
-
SHA256
c47eaf7ee83ea4f4c990937583fba5e25b89a8f99cc67612ab25bdb9559df6ce
-
SHA512
2a85750203a863aa5e212162cb652295113c3ab4ea33d118bce4eb528e9b1e3df1d089ea5b199109f77f7b88db7181b2411fddb5826b4b5e48f1080bdc62f8bb
-
SSDEEP
12288:/U5rCOTeiD/DE+m80aOC9gHjucI3il5SNZ:/UQOJD7zL4CiHrQI5SN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4996 3E5C.tmp 3580 3FE2.tmp 4000 44A5.tmp 4288 464B.tmp 4292 4726.tmp 3876 482F.tmp 4868 48FB.tmp 5080 49E5.tmp 3704 4A91.tmp 2812 4B5C.tmp 3148 4C66.tmp 3132 4D40.tmp 4972 4DCD.tmp 2756 4EA8.tmp 2996 4F25.tmp 264 4FD1.tmp 1928 506D.tmp 2452 5119.tmp 1916 51F3.tmp 4524 52ED.tmp 1416 53A9.tmp 3464 5493.tmp 3972 5530.tmp 4060 55DB.tmp 2008 56A7.tmp 4100 57A1.tmp 1668 587B.tmp 2136 5966.tmp 1156 5A21.tmp 2228 5ADD.tmp 1304 5B79.tmp 4720 5C06.tmp 1732 5CB1.tmp 1912 5D2E.tmp 4816 5DAB.tmp 2512 5E38.tmp 2440 5EC5.tmp 5028 5F71.tmp 2492 5FFD.tmp 408 60A9.tmp 1752 6174.tmp 2172 624F.tmp 3552 62BC.tmp 3956 6387.tmp 4772 6424.tmp 5044 64B0.tmp 3000 654D.tmp 2284 65CA.tmp 4760 6637.tmp 4684 66D3.tmp 2868 676F.tmp 4836 680C.tmp 4308 68C7.tmp 3452 6973.tmp 1808 69F0.tmp 1408 6A8C.tmp 3772 6B19.tmp 3580 6B96.tmp 544 6C32.tmp 1192 6CBF.tmp 4612 6D7A.tmp 4036 6E07.tmp 3748 6EC2.tmp 4980 6F4F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1404 wrote to memory of 4996 1404 50cb02768e80060a124a9b7482be51b7_mafia_JC.exe 81 PID 1404 wrote to memory of 4996 1404 50cb02768e80060a124a9b7482be51b7_mafia_JC.exe 81 PID 1404 wrote to memory of 4996 1404 50cb02768e80060a124a9b7482be51b7_mafia_JC.exe 81 PID 4996 wrote to memory of 3580 4996 3E5C.tmp 82 PID 4996 wrote to memory of 3580 4996 3E5C.tmp 82 PID 4996 wrote to memory of 3580 4996 3E5C.tmp 82 PID 3580 wrote to memory of 4000 3580 3FE2.tmp 83 PID 3580 wrote to memory of 4000 3580 3FE2.tmp 83 PID 3580 wrote to memory of 4000 3580 3FE2.tmp 83 PID 4000 wrote to memory of 4288 4000 44A5.tmp 84 PID 4000 wrote to memory of 4288 4000 44A5.tmp 84 PID 4000 wrote to memory of 4288 4000 44A5.tmp 84 PID 4288 wrote to memory of 4292 4288 464B.tmp 85 PID 4288 wrote to memory of 4292 4288 464B.tmp 85 PID 4288 wrote to memory of 4292 4288 464B.tmp 85 PID 4292 wrote to memory of 3876 4292 4726.tmp 86 PID 4292 wrote to memory of 3876 4292 4726.tmp 86 PID 4292 wrote to memory of 3876 4292 4726.tmp 86 PID 3876 wrote to memory of 4868 3876 482F.tmp 87 PID 3876 wrote to memory of 4868 3876 482F.tmp 87 PID 3876 wrote to memory of 4868 3876 482F.tmp 87 PID 4868 wrote to memory of 5080 4868 48FB.tmp 88 PID 4868 wrote to memory of 5080 4868 48FB.tmp 88 PID 4868 wrote to memory of 5080 4868 48FB.tmp 88 PID 5080 wrote to memory of 3704 5080 49E5.tmp 89 PID 5080 wrote to memory of 3704 5080 49E5.tmp 89 PID 5080 wrote to memory of 3704 5080 49E5.tmp 89 PID 3704 wrote to memory of 2812 3704 4A91.tmp 90 PID 3704 wrote to memory of 2812 3704 4A91.tmp 90 PID 3704 wrote to memory of 2812 3704 4A91.tmp 90 PID 2812 wrote to memory of 3148 2812 4B5C.tmp 91 PID 2812 wrote to memory of 3148 2812 4B5C.tmp 91 PID 2812 wrote to memory of 3148 2812 4B5C.tmp 91 PID 3148 wrote to memory of 3132 3148 4C66.tmp 92 PID 3148 wrote to memory of 3132 3148 4C66.tmp 92 PID 3148 wrote to memory of 3132 3148 4C66.tmp 92 PID 3132 wrote to memory of 4972 3132 4D40.tmp 93 PID 3132 wrote to memory of 4972 3132 4D40.tmp 93 PID 3132 wrote to memory of 4972 3132 4D40.tmp 93 PID 4972 wrote to memory of 2756 4972 4DCD.tmp 94 PID 4972 wrote to memory of 2756 4972 4DCD.tmp 94 PID 4972 wrote to memory of 2756 4972 4DCD.tmp 94 PID 2756 wrote to memory of 2996 2756 4EA8.tmp 96 PID 2756 wrote to memory of 2996 2756 4EA8.tmp 96 PID 2756 wrote to memory of 2996 2756 4EA8.tmp 96 PID 2996 wrote to memory of 264 2996 4F25.tmp 97 PID 2996 wrote to memory of 264 2996 4F25.tmp 97 PID 2996 wrote to memory of 264 2996 4F25.tmp 97 PID 264 wrote to memory of 1928 264 4FD1.tmp 98 PID 264 wrote to memory of 1928 264 4FD1.tmp 98 PID 264 wrote to memory of 1928 264 4FD1.tmp 98 PID 1928 wrote to memory of 2452 1928 506D.tmp 99 PID 1928 wrote to memory of 2452 1928 506D.tmp 99 PID 1928 wrote to memory of 2452 1928 506D.tmp 99 PID 2452 wrote to memory of 1916 2452 5119.tmp 100 PID 2452 wrote to memory of 1916 2452 5119.tmp 100 PID 2452 wrote to memory of 1916 2452 5119.tmp 100 PID 1916 wrote to memory of 4524 1916 51F3.tmp 101 PID 1916 wrote to memory of 4524 1916 51F3.tmp 101 PID 1916 wrote to memory of 4524 1916 51F3.tmp 101 PID 4524 wrote to memory of 1416 4524 52ED.tmp 102 PID 4524 wrote to memory of 1416 4524 52ED.tmp 102 PID 4524 wrote to memory of 1416 4524 52ED.tmp 102 PID 1416 wrote to memory of 3464 1416 53A9.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\50cb02768e80060a124a9b7482be51b7_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\50cb02768e80060a124a9b7482be51b7_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"23⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"24⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"25⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"26⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"27⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"28⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"29⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"30⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"31⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"32⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"33⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"34⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"35⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"36⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"37⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"38⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"39⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"40⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"41⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"42⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"43⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\62BC.tmp"C:\Users\Admin\AppData\Local\Temp\62BC.tmp"44⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"45⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"46⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"47⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"48⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"49⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"50⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"51⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"52⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"53⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"54⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"55⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"56⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"C:\Users\Admin\AppData\Local\Temp\6A8C.tmp"57⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"58⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"59⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"60⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"61⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"62⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"63⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"64⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"65⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"66⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"67⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"68⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"69⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"70⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"71⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"72⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"73⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"74⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"75⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"76⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"77⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"78⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"79⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"80⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"81⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"82⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7923.tmp"C:\Users\Admin\AppData\Local\Temp\7923.tmp"83⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"84⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"85⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"86⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"87⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"88⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"89⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"90⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"91⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7E24.tmp"C:\Users\Admin\AppData\Local\Temp\7E24.tmp"92⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"93⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"94⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"95⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"96⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"97⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"98⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"99⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"100⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"101⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\8335.tmp"C:\Users\Admin\AppData\Local\Temp\8335.tmp"102⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"103⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"104⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\84AC.tmp"C:\Users\Admin\AppData\Local\Temp\84AC.tmp"105⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\8529.tmp"C:\Users\Admin\AppData\Local\Temp\8529.tmp"106⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"107⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"108⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"109⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\874C.tmp"C:\Users\Admin\AppData\Local\Temp\874C.tmp"110⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"111⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"112⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\88D2.tmp"C:\Users\Admin\AppData\Local\Temp\88D2.tmp"113⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\895F.tmp"C:\Users\Admin\AppData\Local\Temp\895F.tmp"114⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"115⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"116⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"117⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8C5D.tmp"C:\Users\Admin\AppData\Local\Temp\8C5D.tmp"118⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"119⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"120⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"121⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\8E70.tmp"C:\Users\Admin\AppData\Local\Temp\8E70.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-