Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe
Resource
win10v2004-20230824-en
2 signatures
150 seconds
General
-
Target
838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe
-
Size
486KB
-
MD5
838834cbf0381c9a26f23ee82f2d3cde
-
SHA1
85e6b4a2a1a82f11792e0e409dfdd11be3b3da64
-
SHA256
e01071c03ba1835af4e446dd9c9875f673133a6e68edfa72fd67d3acea04b0c9
-
SHA512
e6a3a940b31aeef8ab4f8ca201c117eb5130d6f5b6f6f454c0840a2298bd964aed5ddcc8d7ab1a2bb48f2af6e0a12ed92a82fa9af3f49ef0930c6cfb888c2a36
-
SSDEEP
12288:/U5rCOTeiDq/iTySegFkYzBacNbqkyNivmNZ:/UQOJDq/iTySegFkYzEubqkEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4364 EC63.tmp 2556 ED8C.tmp 2480 EE48.tmp 1132 EF23.tmp 1368 F01D.tmp 1832 F0F7.tmp 4552 F4D0.tmp 3448 F627.tmp 4432 F898.tmp 3972 F915.tmp 708 F9C1.tmp 1620 FA7D.tmp 1688 FB67.tmp 4576 FC23.tmp 3796 FCEE.tmp 2008 FD8A.tmp 968 FE94.tmp 656 B.tmp 5060 B7.tmp 2148 182.tmp 3880 24D.tmp 3812 308.tmp 2120 3E3.tmp 2068 4AE.tmp 5076 599.tmp 640 635.tmp 1684 710.tmp 4236 7DB.tmp 844 858.tmp 4956 904.tmp 2304 9EE.tmp 3944 AC9.tmp 2056 B94.tmp 2196 C11.tmp 2760 C9D.tmp 2484 D3A.tmp 4348 DA7.tmp 4180 E24.tmp 4716 EB1.tmp 2412 F2E.tmp 2216 F9B.tmp 1944 1028.tmp 32 10B4.tmp 1312 1151.tmp 3012 11ED.tmp 1536 126A.tmp 4244 12E7.tmp 1100 1393.tmp 4380 148D.tmp 4240 150A.tmp 2016 1587.tmp 4364 1604.tmp 2720 1681.tmp 344 16FE.tmp 2004 177B.tmp 1656 1836.tmp 2188 18A4.tmp 1368 1921.tmp 4404 198E.tmp 4836 1A0B.tmp 1376 1AB7.tmp 3448 1B92.tmp 5116 1C6C.tmp 436 1D09.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4364 5112 838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe 84 PID 5112 wrote to memory of 4364 5112 838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe 84 PID 5112 wrote to memory of 4364 5112 838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe 84 PID 4364 wrote to memory of 2556 4364 EC63.tmp 85 PID 4364 wrote to memory of 2556 4364 EC63.tmp 85 PID 4364 wrote to memory of 2556 4364 EC63.tmp 85 PID 2556 wrote to memory of 2480 2556 ED8C.tmp 86 PID 2556 wrote to memory of 2480 2556 ED8C.tmp 86 PID 2556 wrote to memory of 2480 2556 ED8C.tmp 86 PID 2480 wrote to memory of 1132 2480 EE48.tmp 88 PID 2480 wrote to memory of 1132 2480 EE48.tmp 88 PID 2480 wrote to memory of 1132 2480 EE48.tmp 88 PID 1132 wrote to memory of 1368 1132 EF23.tmp 89 PID 1132 wrote to memory of 1368 1132 EF23.tmp 89 PID 1132 wrote to memory of 1368 1132 EF23.tmp 89 PID 1368 wrote to memory of 1832 1368 F01D.tmp 90 PID 1368 wrote to memory of 1832 1368 F01D.tmp 90 PID 1368 wrote to memory of 1832 1368 F01D.tmp 90 PID 1832 wrote to memory of 4552 1832 F0F7.tmp 91 PID 1832 wrote to memory of 4552 1832 F0F7.tmp 91 PID 1832 wrote to memory of 4552 1832 F0F7.tmp 91 PID 4552 wrote to memory of 3448 4552 F4D0.tmp 92 PID 4552 wrote to memory of 3448 4552 F4D0.tmp 92 PID 4552 wrote to memory of 3448 4552 F4D0.tmp 92 PID 3448 wrote to memory of 4432 3448 F627.tmp 93 PID 3448 wrote to memory of 4432 3448 F627.tmp 93 PID 3448 wrote to memory of 4432 3448 F627.tmp 93 PID 4432 wrote to memory of 3972 4432 F898.tmp 94 PID 4432 wrote to memory of 3972 4432 F898.tmp 94 PID 4432 wrote to memory of 3972 4432 F898.tmp 94 PID 3972 wrote to memory of 708 3972 F915.tmp 95 PID 3972 wrote to memory of 708 3972 F915.tmp 95 PID 3972 wrote to memory of 708 3972 F915.tmp 95 PID 708 wrote to memory of 1620 708 F9C1.tmp 96 PID 708 wrote to memory of 1620 708 F9C1.tmp 96 PID 708 wrote to memory of 1620 708 F9C1.tmp 96 PID 1620 wrote to memory of 1688 1620 FA7D.tmp 97 PID 1620 wrote to memory of 1688 1620 FA7D.tmp 97 PID 1620 wrote to memory of 1688 1620 FA7D.tmp 97 PID 1688 wrote to memory of 4576 1688 FB67.tmp 98 PID 1688 wrote to memory of 4576 1688 FB67.tmp 98 PID 1688 wrote to memory of 4576 1688 FB67.tmp 98 PID 4576 wrote to memory of 3796 4576 FC23.tmp 99 PID 4576 wrote to memory of 3796 4576 FC23.tmp 99 PID 4576 wrote to memory of 3796 4576 FC23.tmp 99 PID 3796 wrote to memory of 2008 3796 FCEE.tmp 100 PID 3796 wrote to memory of 2008 3796 FCEE.tmp 100 PID 3796 wrote to memory of 2008 3796 FCEE.tmp 100 PID 2008 wrote to memory of 968 2008 FD8A.tmp 101 PID 2008 wrote to memory of 968 2008 FD8A.tmp 101 PID 2008 wrote to memory of 968 2008 FD8A.tmp 101 PID 968 wrote to memory of 656 968 FE94.tmp 102 PID 968 wrote to memory of 656 968 FE94.tmp 102 PID 968 wrote to memory of 656 968 FE94.tmp 102 PID 656 wrote to memory of 5060 656 B.tmp 103 PID 656 wrote to memory of 5060 656 B.tmp 103 PID 656 wrote to memory of 5060 656 B.tmp 103 PID 5060 wrote to memory of 2148 5060 B7.tmp 104 PID 5060 wrote to memory of 2148 5060 B7.tmp 104 PID 5060 wrote to memory of 2148 5060 B7.tmp 104 PID 2148 wrote to memory of 3880 2148 182.tmp 105 PID 2148 wrote to memory of 3880 2148 182.tmp 105 PID 2148 wrote to memory of 3880 2148 182.tmp 105 PID 3880 wrote to memory of 3812 3880 24D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\838834cbf0381c9a26f23ee82f2d3cde_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"C:\Users\Admin\AppData\Local\Temp\FA7D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\FB67.tmp"C:\Users\Admin\AppData\Local\Temp\FB67.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\FC23.tmp"C:\Users\Admin\AppData\Local\Temp\FC23.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"C:\Users\Admin\AppData\Local\Temp\FCEE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"C:\Users\Admin\AppData\Local\Temp\FD8A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\308.tmp"C:\Users\Admin\AppData\Local\Temp\308.tmp"23⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"24⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4AE.tmp"C:\Users\Admin\AppData\Local\Temp\4AE.tmp"25⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"26⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"27⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"28⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7DB.tmp"C:\Users\Admin\AppData\Local\Temp\7DB.tmp"29⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"30⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\904.tmp"C:\Users\Admin\AppData\Local\Temp\904.tmp"31⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"32⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"33⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"34⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\C11.tmp"C:\Users\Admin\AppData\Local\Temp\C11.tmp"35⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"36⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"37⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"38⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"39⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"40⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"41⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"42⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\1028.tmp"C:\Users\Admin\AppData\Local\Temp\1028.tmp"43⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"44⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"45⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"46⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"47⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"48⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"49⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"50⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"51⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"52⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"53⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"54⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\1681.tmp"C:\Users\Admin\AppData\Local\Temp\1681.tmp"55⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"56⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"57⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"58⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"59⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1921.tmp"C:\Users\Admin\AppData\Local\Temp\1921.tmp"60⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"61⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"62⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"63⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"64⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"65⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"66⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\1D76.tmp"C:\Users\Admin\AppData\Local\Temp\1D76.tmp"67⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"68⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"69⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"70⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"71⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"72⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"73⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"74⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"75⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"76⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"77⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"78⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\23CF.tmp"C:\Users\Admin\AppData\Local\Temp\23CF.tmp"79⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"80⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"81⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"82⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"83⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"84⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"85⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"86⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"87⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"88⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"89⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"90⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"91⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"92⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"93⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"94⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"95⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"96⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"97⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"98⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"99⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"100⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\31C9.tmp"C:\Users\Admin\AppData\Local\Temp\31C9.tmp"101⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"102⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"103⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"104⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"105⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"106⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"107⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"108⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"109⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"110⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"111⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"112⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"113⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"C:\Users\Admin\AppData\Local\Temp\3B6E.tmp"114⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"115⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"116⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"117⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"118⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"119⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"120⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"121⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-