Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe
-
Size
486KB
-
MD5
50e34ecfaf6cc6c480f33b1b1f09d2c6
-
SHA1
31c682834da0190ca627b535129125c469fc11a6
-
SHA256
fb3b6fc126b0174285b2b406214ad6f7492f01a2af8d6ecef7ea3d8f3baa76d7
-
SHA512
aedc4be61519e2e6c8af6dfd7528ac3291bc4d75c97851b2b7560c83da3b54bb53a500a9607dc92bb5e3d460825318efb293229a34053df807771b07f2c3c345
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7h7NgoTDTAMrvo/3Ba/WZRPsfgXhaJTeZBtmB:UU5rCOTeiDh7Ds3KEqfM2DEj4NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4160 802C.tmp 772 80C9.tmp 808 8184.tmp 2072 825F.tmp 4336 82DC.tmp 3680 8378.tmp 3240 8424.tmp 4688 84C0.tmp 2756 856C.tmp 1924 8637.tmp 1520 86E3.tmp 4528 877F.tmp 1904 880C.tmp 3920 88B8.tmp 4328 8AAC.tmp 3832 8BA6.tmp 3540 8C42.tmp 5104 8CDE.tmp 1668 8D8A.tmp 3260 8E55.tmp 4868 8EF2.tmp 316 8FCC.tmp 4976 90C6.tmp 3104 91A1.tmp 4192 927C.tmp 2792 9318.tmp 3396 93E3.tmp 1348 948F.tmp 1576 951C.tmp 3608 95E7.tmp 3696 9673.tmp 4972 975E.tmp 4464 980A.tmp 3692 9877.tmp 572 9904.tmp 4080 99B0.tmp 4804 9A2D.tmp 4704 9AB9.tmp 796 9B55.tmp 1756 9BE2.tmp 3600 9C5F.tmp 2108 9CEC.tmp 1476 9D78.tmp 2152 9DF5.tmp 2516 9E82.tmp 3864 9F0F.tmp 4848 9FAB.tmp 4536 A037.tmp 3080 A0C4.tmp 844 A151.tmp 4160 A1DD.tmp 3092 A289.tmp 3752 A2F7.tmp 1124 A383.tmp 4180 A3F1.tmp 3844 A4AC.tmp 3716 A529.tmp 3336 A5C5.tmp 4004 A652.tmp 4792 A6EE.tmp 2580 A77B.tmp 5008 A807.tmp 1388 A894.tmp 4200 A921.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 4160 468 50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe 81 PID 468 wrote to memory of 4160 468 50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe 81 PID 468 wrote to memory of 4160 468 50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe 81 PID 4160 wrote to memory of 772 4160 802C.tmp 82 PID 4160 wrote to memory of 772 4160 802C.tmp 82 PID 4160 wrote to memory of 772 4160 802C.tmp 82 PID 772 wrote to memory of 808 772 80C9.tmp 83 PID 772 wrote to memory of 808 772 80C9.tmp 83 PID 772 wrote to memory of 808 772 80C9.tmp 83 PID 808 wrote to memory of 2072 808 8184.tmp 84 PID 808 wrote to memory of 2072 808 8184.tmp 84 PID 808 wrote to memory of 2072 808 8184.tmp 84 PID 2072 wrote to memory of 4336 2072 825F.tmp 85 PID 2072 wrote to memory of 4336 2072 825F.tmp 85 PID 2072 wrote to memory of 4336 2072 825F.tmp 85 PID 4336 wrote to memory of 3680 4336 82DC.tmp 86 PID 4336 wrote to memory of 3680 4336 82DC.tmp 86 PID 4336 wrote to memory of 3680 4336 82DC.tmp 86 PID 3680 wrote to memory of 3240 3680 8378.tmp 87 PID 3680 wrote to memory of 3240 3680 8378.tmp 87 PID 3680 wrote to memory of 3240 3680 8378.tmp 87 PID 3240 wrote to memory of 4688 3240 8424.tmp 88 PID 3240 wrote to memory of 4688 3240 8424.tmp 88 PID 3240 wrote to memory of 4688 3240 8424.tmp 88 PID 4688 wrote to memory of 2756 4688 84C0.tmp 89 PID 4688 wrote to memory of 2756 4688 84C0.tmp 89 PID 4688 wrote to memory of 2756 4688 84C0.tmp 89 PID 2756 wrote to memory of 1924 2756 856C.tmp 91 PID 2756 wrote to memory of 1924 2756 856C.tmp 91 PID 2756 wrote to memory of 1924 2756 856C.tmp 91 PID 1924 wrote to memory of 1520 1924 8637.tmp 92 PID 1924 wrote to memory of 1520 1924 8637.tmp 92 PID 1924 wrote to memory of 1520 1924 8637.tmp 92 PID 1520 wrote to memory of 4528 1520 86E3.tmp 93 PID 1520 wrote to memory of 4528 1520 86E3.tmp 93 PID 1520 wrote to memory of 4528 1520 86E3.tmp 93 PID 4528 wrote to memory of 1904 4528 877F.tmp 94 PID 4528 wrote to memory of 1904 4528 877F.tmp 94 PID 4528 wrote to memory of 1904 4528 877F.tmp 94 PID 1904 wrote to memory of 3920 1904 880C.tmp 95 PID 1904 wrote to memory of 3920 1904 880C.tmp 95 PID 1904 wrote to memory of 3920 1904 880C.tmp 95 PID 3920 wrote to memory of 4328 3920 88B8.tmp 96 PID 3920 wrote to memory of 4328 3920 88B8.tmp 96 PID 3920 wrote to memory of 4328 3920 88B8.tmp 96 PID 4328 wrote to memory of 3832 4328 8AAC.tmp 97 PID 4328 wrote to memory of 3832 4328 8AAC.tmp 97 PID 4328 wrote to memory of 3832 4328 8AAC.tmp 97 PID 3832 wrote to memory of 3540 3832 8BA6.tmp 98 PID 3832 wrote to memory of 3540 3832 8BA6.tmp 98 PID 3832 wrote to memory of 3540 3832 8BA6.tmp 98 PID 3540 wrote to memory of 5104 3540 8C42.tmp 99 PID 3540 wrote to memory of 5104 3540 8C42.tmp 99 PID 3540 wrote to memory of 5104 3540 8C42.tmp 99 PID 5104 wrote to memory of 1668 5104 8CDE.tmp 100 PID 5104 wrote to memory of 1668 5104 8CDE.tmp 100 PID 5104 wrote to memory of 1668 5104 8CDE.tmp 100 PID 1668 wrote to memory of 3260 1668 8D8A.tmp 103 PID 1668 wrote to memory of 3260 1668 8D8A.tmp 103 PID 1668 wrote to memory of 3260 1668 8D8A.tmp 103 PID 3260 wrote to memory of 4868 3260 8E55.tmp 104 PID 3260 wrote to memory of 4868 3260 8E55.tmp 104 PID 3260 wrote to memory of 4868 3260 8E55.tmp 104 PID 4868 wrote to memory of 316 4868 8EF2.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\50e34ecfaf6cc6c480f33b1b1f09d2c6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"23⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"24⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"25⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"26⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"27⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"28⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"29⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"30⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"31⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"32⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"33⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"34⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"35⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"36⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"37⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"38⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"39⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"40⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"41⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"42⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"43⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"44⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"45⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"46⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"47⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"48⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"49⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"50⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"51⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"52⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"53⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"54⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"55⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"56⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"57⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"58⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"59⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"60⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"61⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"62⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"63⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"64⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"65⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"66⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"67⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"68⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"69⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"70⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"71⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"72⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"73⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"74⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"75⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"76⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"77⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"78⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"79⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"80⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"81⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"82⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"83⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"84⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"85⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"86⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"87⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"88⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"89⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"90⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"91⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"92⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"93⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"94⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"95⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"96⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"97⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"98⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"99⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"101⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"102⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\BC89.tmp"C:\Users\Admin\AppData\Local\Temp\BC89.tmp"103⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"104⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"105⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"106⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"107⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"108⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"109⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"110⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"111⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"112⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"113⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"114⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"115⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"116⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"117⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"118⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"119⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"120⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"121⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-