Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe
-
Size
488KB
-
MD5
5629243f4bad30e75e5b96ad2677ec02
-
SHA1
8532f7a3c576d4500c61d355d72b5d6f9bfb68a8
-
SHA256
48b12d64b5f266e35460353c6f15268360f2e12c012b40eabb9633237cead114
-
SHA512
443241d2033656ab7bed1f45ec6c2d648002d3a4bc51f09e5a202947314c70883a517b7721eec66167f48fa24548247ce1aa6e83feef0ef90cbff9789d5b4b88
-
SSDEEP
12288:/U5rCOTeiDpgDfS6P0gOg17tGK9pPRtJawuVIgNZ:/UQOJDpgVDOgRtGK9pPRt8wuVN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1748 2277.tmp 3352 23BF.tmp 3672 24B9.tmp 3168 25A4.tmp 3748 2650.tmp 4920 272A.tmp 4800 2824.tmp 3580 290F.tmp 4316 2A66.tmp 4880 2B12.tmp 1520 2BDD.tmp 952 2C89.tmp 1516 2E10.tmp 3732 2EBC.tmp 4624 3004.tmp 112 312D.tmp 2024 3227.tmp 2216 3302.tmp 3640 33EC.tmp 2484 3488.tmp 100 360F.tmp 2680 36AB.tmp 2740 3776.tmp 4564 3822.tmp 2460 38CE.tmp 4764 397A.tmp 2004 3A35.tmp 2472 3AF1.tmp 4428 3BBC.tmp 1064 3CF4.tmp 4708 3DFE.tmp 2308 3EE8.tmp 984 3FE2.tmp 4468 40EC.tmp 5012 41A8.tmp 4804 433E.tmp 3512 43DA.tmp 216 44D4.tmp 4592 4580.tmp 4400 46B8.tmp 2524 4784.tmp 4100 4820.tmp 1352 48BC.tmp 2332 4968.tmp 4720 4A91.tmp 2640 4B3D.tmp 1612 4BC9.tmp 1440 4C85.tmp 4612 4D21.tmp 2800 4D9E.tmp 2452 4E3A.tmp 3344 4ED7.tmp 1856 4F73.tmp 4360 501F.tmp 2996 509C.tmp 3788 5242.tmp 2548 530D.tmp 4588 538A.tmp 4376 5407.tmp 2232 54A3.tmp 3868 5520.tmp 3900 55CC.tmp 4300 56C6.tmp 2112 57DF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1748 4568 5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe 80 PID 4568 wrote to memory of 1748 4568 5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe 80 PID 4568 wrote to memory of 1748 4568 5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe 80 PID 1748 wrote to memory of 3352 1748 2277.tmp 81 PID 1748 wrote to memory of 3352 1748 2277.tmp 81 PID 1748 wrote to memory of 3352 1748 2277.tmp 81 PID 3352 wrote to memory of 3672 3352 23BF.tmp 82 PID 3352 wrote to memory of 3672 3352 23BF.tmp 82 PID 3352 wrote to memory of 3672 3352 23BF.tmp 82 PID 3672 wrote to memory of 3168 3672 24B9.tmp 83 PID 3672 wrote to memory of 3168 3672 24B9.tmp 83 PID 3672 wrote to memory of 3168 3672 24B9.tmp 83 PID 3168 wrote to memory of 3748 3168 25A4.tmp 84 PID 3168 wrote to memory of 3748 3168 25A4.tmp 84 PID 3168 wrote to memory of 3748 3168 25A4.tmp 84 PID 3748 wrote to memory of 4920 3748 2650.tmp 85 PID 3748 wrote to memory of 4920 3748 2650.tmp 85 PID 3748 wrote to memory of 4920 3748 2650.tmp 85 PID 4920 wrote to memory of 4800 4920 272A.tmp 86 PID 4920 wrote to memory of 4800 4920 272A.tmp 86 PID 4920 wrote to memory of 4800 4920 272A.tmp 86 PID 4800 wrote to memory of 3580 4800 2824.tmp 87 PID 4800 wrote to memory of 3580 4800 2824.tmp 87 PID 4800 wrote to memory of 3580 4800 2824.tmp 87 PID 3580 wrote to memory of 4316 3580 290F.tmp 88 PID 3580 wrote to memory of 4316 3580 290F.tmp 88 PID 3580 wrote to memory of 4316 3580 290F.tmp 88 PID 4316 wrote to memory of 4880 4316 2A66.tmp 89 PID 4316 wrote to memory of 4880 4316 2A66.tmp 89 PID 4316 wrote to memory of 4880 4316 2A66.tmp 89 PID 4880 wrote to memory of 1520 4880 2B12.tmp 90 PID 4880 wrote to memory of 1520 4880 2B12.tmp 90 PID 4880 wrote to memory of 1520 4880 2B12.tmp 90 PID 1520 wrote to memory of 952 1520 2BDD.tmp 91 PID 1520 wrote to memory of 952 1520 2BDD.tmp 91 PID 1520 wrote to memory of 952 1520 2BDD.tmp 91 PID 952 wrote to memory of 1516 952 2C89.tmp 92 PID 952 wrote to memory of 1516 952 2C89.tmp 92 PID 952 wrote to memory of 1516 952 2C89.tmp 92 PID 1516 wrote to memory of 3732 1516 2E10.tmp 93 PID 1516 wrote to memory of 3732 1516 2E10.tmp 93 PID 1516 wrote to memory of 3732 1516 2E10.tmp 93 PID 3732 wrote to memory of 4624 3732 2EBC.tmp 94 PID 3732 wrote to memory of 4624 3732 2EBC.tmp 94 PID 3732 wrote to memory of 4624 3732 2EBC.tmp 94 PID 4624 wrote to memory of 112 4624 3004.tmp 95 PID 4624 wrote to memory of 112 4624 3004.tmp 95 PID 4624 wrote to memory of 112 4624 3004.tmp 95 PID 112 wrote to memory of 2024 112 312D.tmp 96 PID 112 wrote to memory of 2024 112 312D.tmp 96 PID 112 wrote to memory of 2024 112 312D.tmp 96 PID 2024 wrote to memory of 2216 2024 3227.tmp 97 PID 2024 wrote to memory of 2216 2024 3227.tmp 97 PID 2024 wrote to memory of 2216 2024 3227.tmp 97 PID 2216 wrote to memory of 3640 2216 3302.tmp 98 PID 2216 wrote to memory of 3640 2216 3302.tmp 98 PID 2216 wrote to memory of 3640 2216 3302.tmp 98 PID 3640 wrote to memory of 2484 3640 33EC.tmp 100 PID 3640 wrote to memory of 2484 3640 33EC.tmp 100 PID 3640 wrote to memory of 2484 3640 33EC.tmp 100 PID 2484 wrote to memory of 100 2484 3488.tmp 101 PID 2484 wrote to memory of 100 2484 3488.tmp 101 PID 2484 wrote to memory of 100 2484 3488.tmp 101 PID 100 wrote to memory of 2680 100 360F.tmp 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5629243f4bad30e75e5b96ad2677ec02_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"23⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"24⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"25⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"26⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"27⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"28⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"29⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"30⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"31⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"32⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"33⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"34⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"35⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"36⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"37⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"38⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"39⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"40⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"41⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"42⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"43⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"44⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"45⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"46⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"47⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"48⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"49⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"50⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"51⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"52⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"53⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"54⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"55⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"56⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"57⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"58⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"60⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"61⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"62⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"63⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"64⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\57DF.tmp"C:\Users\Admin\AppData\Local\Temp\57DF.tmp"65⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"67⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"68⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"69⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"70⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"71⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"72⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"73⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"74⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"75⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"76⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"77⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"78⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"79⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"80⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"81⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"82⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"83⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"84⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"85⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"86⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"87⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\676F.tmp"C:\Users\Admin\AppData\Local\Temp\676F.tmp"88⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"89⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"90⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"92⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"93⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"94⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"95⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"C:\Users\Admin\AppData\Local\Temp\6BE4.tmp"96⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6C80.tmp"C:\Users\Admin\AppData\Local\Temp\6C80.tmp"97⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"98⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"99⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"100⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"101⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"102⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"103⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"104⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"105⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"106⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"107⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"108⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"109⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"110⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"111⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"112⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\75F6.tmp"C:\Users\Admin\AppData\Local\Temp\75F6.tmp"113⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"114⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"115⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"116⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"117⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"118⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"119⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\79AF.tmp"C:\Users\Admin\AppData\Local\Temp\79AF.tmp"120⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"C:\Users\Admin\AppData\Local\Temp\7A5B.tmp"121⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"122⤵PID:3720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-