Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe
-
Size
488KB
-
MD5
9695d7177d72d9edcb1cbfed791becc6
-
SHA1
48d7eb1db02e0ec9dc89b74e5176be3cdfb2d220
-
SHA256
655ac8ceba6eff115e2f7ac9d56e0d3b868ca914df8f47422d9ab42f3d83c8cf
-
SHA512
2f3e17952897ba9c58ae7a54e10d4af560083488125bf0b57d15ec483f00753c5cfc49291f4652f3c1ca59028d2247f2ec9545b2789de8760c0753b00d44e457
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7F0AghCSbUKJjo45kLUbAKZeTc33jqJcnCVNt:/U5rCOTeiDFshCEf6YcKUTcZf+NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4208 8174.tmp 2428 8211.tmp 2132 831A.tmp 2864 83F5.tmp 1904 84C0.tmp 4980 858B.tmp 4048 8666.tmp 3380 8722.tmp 824 87CD.tmp 1260 8889.tmp 4184 8973.tmp 2604 8A00.tmp 1856 8B48.tmp 4716 8BF4.tmp 4480 8CFE.tmp 2140 8DC9.tmp 4828 8EC3.tmp 1456 8FEC.tmp 1728 9078.tmp 4992 9124.tmp 1836 921E.tmp 3736 9308.tmp 3180 93C4.tmp 3888 94DD.tmp 3168 95C8.tmp 1344 9654.tmp 4512 975E.tmp 2800 9819.tmp 1200 98E4.tmp 3980 99CF.tmp 1676 9A4C.tmp 1548 9B17.tmp 2516 9BD2.tmp 4768 9C4F.tmp 2280 9CFB.tmp 4720 9D98.tmp 4024 9E43.tmp 3100 9EC0.tmp 3400 9F5D.tmp 4744 A018.tmp 3280 A0C4.tmp 3652 A131.tmp 916 A1CE.tmp 1204 A289.tmp 1680 A316.tmp 1704 A3A2.tmp 5088 A42F.tmp 556 A4CB.tmp 520 A604.tmp 1832 A681.tmp 4196 A6FE.tmp 216 A79A.tmp 4424 A836.tmp 1144 A8E2.tmp 3772 A96F.tmp 4748 AA1B.tmp 3348 AA98.tmp 404 AB34.tmp 416 ABE0.tmp 1960 AC6C.tmp 2368 AD18.tmp 4676 AD95.tmp 4128 AE03.tmp 4664 AE80.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4208 4928 9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe 82 PID 4928 wrote to memory of 4208 4928 9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe 82 PID 4928 wrote to memory of 4208 4928 9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe 82 PID 4208 wrote to memory of 2428 4208 8174.tmp 83 PID 4208 wrote to memory of 2428 4208 8174.tmp 83 PID 4208 wrote to memory of 2428 4208 8174.tmp 83 PID 2428 wrote to memory of 2132 2428 8211.tmp 84 PID 2428 wrote to memory of 2132 2428 8211.tmp 84 PID 2428 wrote to memory of 2132 2428 8211.tmp 84 PID 2132 wrote to memory of 2864 2132 831A.tmp 85 PID 2132 wrote to memory of 2864 2132 831A.tmp 85 PID 2132 wrote to memory of 2864 2132 831A.tmp 85 PID 2864 wrote to memory of 1904 2864 83F5.tmp 86 PID 2864 wrote to memory of 1904 2864 83F5.tmp 86 PID 2864 wrote to memory of 1904 2864 83F5.tmp 86 PID 1904 wrote to memory of 4980 1904 84C0.tmp 87 PID 1904 wrote to memory of 4980 1904 84C0.tmp 87 PID 1904 wrote to memory of 4980 1904 84C0.tmp 87 PID 4980 wrote to memory of 4048 4980 858B.tmp 88 PID 4980 wrote to memory of 4048 4980 858B.tmp 88 PID 4980 wrote to memory of 4048 4980 858B.tmp 88 PID 4048 wrote to memory of 3380 4048 8666.tmp 89 PID 4048 wrote to memory of 3380 4048 8666.tmp 89 PID 4048 wrote to memory of 3380 4048 8666.tmp 89 PID 3380 wrote to memory of 824 3380 8722.tmp 90 PID 3380 wrote to memory of 824 3380 8722.tmp 90 PID 3380 wrote to memory of 824 3380 8722.tmp 90 PID 824 wrote to memory of 1260 824 87CD.tmp 91 PID 824 wrote to memory of 1260 824 87CD.tmp 91 PID 824 wrote to memory of 1260 824 87CD.tmp 91 PID 1260 wrote to memory of 4184 1260 8889.tmp 92 PID 1260 wrote to memory of 4184 1260 8889.tmp 92 PID 1260 wrote to memory of 4184 1260 8889.tmp 92 PID 4184 wrote to memory of 2604 4184 8973.tmp 93 PID 4184 wrote to memory of 2604 4184 8973.tmp 93 PID 4184 wrote to memory of 2604 4184 8973.tmp 93 PID 2604 wrote to memory of 1856 2604 8A00.tmp 94 PID 2604 wrote to memory of 1856 2604 8A00.tmp 94 PID 2604 wrote to memory of 1856 2604 8A00.tmp 94 PID 1856 wrote to memory of 4716 1856 8B48.tmp 95 PID 1856 wrote to memory of 4716 1856 8B48.tmp 95 PID 1856 wrote to memory of 4716 1856 8B48.tmp 95 PID 4716 wrote to memory of 4480 4716 8BF4.tmp 96 PID 4716 wrote to memory of 4480 4716 8BF4.tmp 96 PID 4716 wrote to memory of 4480 4716 8BF4.tmp 96 PID 4480 wrote to memory of 2140 4480 8CFE.tmp 97 PID 4480 wrote to memory of 2140 4480 8CFE.tmp 97 PID 4480 wrote to memory of 2140 4480 8CFE.tmp 97 PID 2140 wrote to memory of 4828 2140 8DC9.tmp 98 PID 2140 wrote to memory of 4828 2140 8DC9.tmp 98 PID 2140 wrote to memory of 4828 2140 8DC9.tmp 98 PID 4828 wrote to memory of 1456 4828 8EC3.tmp 99 PID 4828 wrote to memory of 1456 4828 8EC3.tmp 99 PID 4828 wrote to memory of 1456 4828 8EC3.tmp 99 PID 1456 wrote to memory of 1728 1456 8FEC.tmp 100 PID 1456 wrote to memory of 1728 1456 8FEC.tmp 100 PID 1456 wrote to memory of 1728 1456 8FEC.tmp 100 PID 1728 wrote to memory of 4992 1728 9078.tmp 101 PID 1728 wrote to memory of 4992 1728 9078.tmp 101 PID 1728 wrote to memory of 4992 1728 9078.tmp 101 PID 4992 wrote to memory of 1836 4992 9124.tmp 102 PID 4992 wrote to memory of 1836 4992 9124.tmp 102 PID 4992 wrote to memory of 1836 4992 9124.tmp 102 PID 1836 wrote to memory of 3736 1836 921E.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9695d7177d72d9edcb1cbfed791becc6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\8B48.tmp"C:\Users\Admin\AppData\Local\Temp\8B48.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"23⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"24⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"25⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"26⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"27⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"29⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"30⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"31⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"32⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"33⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"34⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"35⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"36⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"37⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"38⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"39⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"40⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"41⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"42⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"43⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"44⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"45⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"46⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"47⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"48⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"49⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"50⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"51⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"52⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"53⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"54⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"55⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"56⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"57⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"58⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"59⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"60⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"61⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"62⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"63⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"64⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"65⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"66⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"67⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"68⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"69⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"70⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"71⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"72⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"73⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"74⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"75⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"76⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"77⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"78⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"79⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"80⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"81⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"82⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"83⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"84⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"85⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"86⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"87⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"88⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"89⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"90⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"91⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"92⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"93⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"94⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"95⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"96⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"97⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"98⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"99⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"100⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"101⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"102⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"103⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"104⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"105⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"106⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"107⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"108⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"109⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"110⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"111⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"112⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"113⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"114⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"115⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"116⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"117⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"118⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"119⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"120⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"121⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-