Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe
Resource
win10v2004-20230824-en
3 signatures
150 seconds
General
-
Target
9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe
-
Size
527KB
-
MD5
9a3bb7ae0a1706dd541fd1b7c5660b0d
-
SHA1
eb9c825dce71e9f91028107686d4a525db30ef49
-
SHA256
f588b51999e926a7853cbeb37f84aa7eb68b44db9ea0a6346f6362168316ec63
-
SHA512
497084604d6ea1de75f4f43f2610a56297b69aed324ce46ba0148523da47ac47786d5a02d4c5631713a95478d6946ef8e328316dba78aa4005929458e50fd1dc
-
SSDEEP
12288:fU5rCOTeidrIDHmOWgv65B0MyporAMDZu:fUQOJdrIDRWd0Myp8Do
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3332 1B15.tmp 4572 1C6C.tmp 4112 249A.tmp 2372 2630.tmp 4552 26EC.tmp 5008 27E6.tmp 2400 28C1.tmp 2228 299B.tmp 4460 2A76.tmp 1164 2B8F.tmp 2328 2C1C.tmp 3788 2D06.tmp 808 2E00.tmp 4716 2EBC.tmp 2000 2F97.tmp 2976 3081.tmp 3276 315C.tmp 1904 3227.tmp 3576 3330.tmp 1252 33EC.tmp 4852 34F6.tmp 2524 35C1.tmp 3232 367C.tmp 2552 3776.tmp 4872 3841.tmp 3864 391C.tmp 1592 39D8.tmp 2168 3A93.tmp 1968 3B3F.tmp 2872 3BCC.tmp 2532 3C87.tmp 2488 3D33.tmp 4144 3E0E.tmp 2428 3E9A.tmp 3844 3F08.tmp 3068 3FB4.tmp 3696 406F.tmp 3628 40DC.tmp 4092 414A.tmp 5068 41E6.tmp 3036 4273.tmp 1300 42F0.tmp 4704 437C.tmp 4692 4409.tmp 2160 4496.tmp 4924 4532.tmp 2788 45BE.tmp 3060 463B.tmp 2380 4707.tmp 4668 4774.tmp 3640 47E1.tmp 4280 486E.tmp 1256 490A.tmp 1540 4978.tmp 1096 4A23.tmp 4900 4AB0.tmp 2696 4B1D.tmp 3376 4C08.tmp 4128 4CA4.tmp 912 4D31.tmp 2204 4DBD.tmp 1556 4E4A.tmp 3792 4ED7.tmp 4864 4F63.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{1E52AE5F-F4E6-4899-B766-FA28AFAE2019}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4668 wrote to memory of 3332 4668 9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe 85 PID 4668 wrote to memory of 3332 4668 9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe 85 PID 4668 wrote to memory of 3332 4668 9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe 85 PID 3332 wrote to memory of 4572 3332 1B15.tmp 86 PID 3332 wrote to memory of 4572 3332 1B15.tmp 86 PID 3332 wrote to memory of 4572 3332 1B15.tmp 86 PID 4572 wrote to memory of 4112 4572 1C6C.tmp 88 PID 4572 wrote to memory of 4112 4572 1C6C.tmp 88 PID 4572 wrote to memory of 4112 4572 1C6C.tmp 88 PID 4112 wrote to memory of 2372 4112 249A.tmp 89 PID 4112 wrote to memory of 2372 4112 249A.tmp 89 PID 4112 wrote to memory of 2372 4112 249A.tmp 89 PID 2372 wrote to memory of 4552 2372 2630.tmp 90 PID 2372 wrote to memory of 4552 2372 2630.tmp 90 PID 2372 wrote to memory of 4552 2372 2630.tmp 90 PID 4552 wrote to memory of 5008 4552 26EC.tmp 91 PID 4552 wrote to memory of 5008 4552 26EC.tmp 91 PID 4552 wrote to memory of 5008 4552 26EC.tmp 91 PID 5008 wrote to memory of 2400 5008 27E6.tmp 92 PID 5008 wrote to memory of 2400 5008 27E6.tmp 92 PID 5008 wrote to memory of 2400 5008 27E6.tmp 92 PID 2400 wrote to memory of 2228 2400 28C1.tmp 94 PID 2400 wrote to memory of 2228 2400 28C1.tmp 94 PID 2400 wrote to memory of 2228 2400 28C1.tmp 94 PID 2228 wrote to memory of 4460 2228 299B.tmp 95 PID 2228 wrote to memory of 4460 2228 299B.tmp 95 PID 2228 wrote to memory of 4460 2228 299B.tmp 95 PID 4460 wrote to memory of 1164 4460 2A76.tmp 96 PID 4460 wrote to memory of 1164 4460 2A76.tmp 96 PID 4460 wrote to memory of 1164 4460 2A76.tmp 96 PID 1164 wrote to memory of 2328 1164 2B8F.tmp 97 PID 1164 wrote to memory of 2328 1164 2B8F.tmp 97 PID 1164 wrote to memory of 2328 1164 2B8F.tmp 97 PID 2328 wrote to memory of 3788 2328 2C1C.tmp 98 PID 2328 wrote to memory of 3788 2328 2C1C.tmp 98 PID 2328 wrote to memory of 3788 2328 2C1C.tmp 98 PID 3788 wrote to memory of 808 3788 2D06.tmp 99 PID 3788 wrote to memory of 808 3788 2D06.tmp 99 PID 3788 wrote to memory of 808 3788 2D06.tmp 99 PID 808 wrote to memory of 4716 808 2E00.tmp 100 PID 808 wrote to memory of 4716 808 2E00.tmp 100 PID 808 wrote to memory of 4716 808 2E00.tmp 100 PID 4716 wrote to memory of 2000 4716 2EBC.tmp 101 PID 4716 wrote to memory of 2000 4716 2EBC.tmp 101 PID 4716 wrote to memory of 2000 4716 2EBC.tmp 101 PID 2000 wrote to memory of 2976 2000 2F97.tmp 102 PID 2000 wrote to memory of 2976 2000 2F97.tmp 102 PID 2000 wrote to memory of 2976 2000 2F97.tmp 102 PID 2976 wrote to memory of 3276 2976 3081.tmp 103 PID 2976 wrote to memory of 3276 2976 3081.tmp 103 PID 2976 wrote to memory of 3276 2976 3081.tmp 103 PID 3276 wrote to memory of 1904 3276 315C.tmp 104 PID 3276 wrote to memory of 1904 3276 315C.tmp 104 PID 3276 wrote to memory of 1904 3276 315C.tmp 104 PID 1904 wrote to memory of 3576 1904 3227.tmp 105 PID 1904 wrote to memory of 3576 1904 3227.tmp 105 PID 1904 wrote to memory of 3576 1904 3227.tmp 105 PID 3576 wrote to memory of 1252 3576 3330.tmp 106 PID 3576 wrote to memory of 1252 3576 3330.tmp 106 PID 3576 wrote to memory of 1252 3576 3330.tmp 106 PID 1252 wrote to memory of 4852 1252 33EC.tmp 107 PID 1252 wrote to memory of 4852 1252 33EC.tmp 107 PID 1252 wrote to memory of 4852 1252 33EC.tmp 107 PID 4852 wrote to memory of 2524 4852 34F6.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\9a3bb7ae0a1706dd541fd1b7c5660b0d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2F97.tmp"C:\Users\Admin\AppData\Local\Temp\2F97.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"23⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"24⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"25⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"26⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"27⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"28⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"29⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"30⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"31⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"32⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"33⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"34⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"C:\Users\Admin\AppData\Local\Temp\3E9A.tmp"35⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"36⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"37⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"38⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"39⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\414A.tmp"C:\Users\Admin\AppData\Local\Temp\414A.tmp"40⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"41⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"42⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"43⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"44⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"45⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"46⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"47⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"48⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"49⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"50⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4774.tmp"C:\Users\Admin\AppData\Local\Temp\4774.tmp"51⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"52⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"53⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"54⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"55⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"56⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"57⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"58⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"59⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"C:\Users\Admin\AppData\Local\Temp\4CA4.tmp"60⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4D31.tmp"C:\Users\Admin\AppData\Local\Temp\4D31.tmp"61⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"62⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"63⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"64⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"65⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"66⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"67⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"68⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"69⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"70⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"71⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"72⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"73⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"74⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"75⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"76⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"77⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"78⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"79⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"80⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"81⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"82⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"83⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"84⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"85⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"86⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"87⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"88⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"89⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"90⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"91⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"92⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\5E28.tmp"C:\Users\Admin\AppData\Local\Temp\5E28.tmp"93⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"94⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"95⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"96⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"97⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"98⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"99⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"100⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"101⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"102⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"103⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"104⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"105⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"106⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"107⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"108⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"109⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"110⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"111⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"112⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"113⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"114⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"115⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"116⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"117⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"118⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"119⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"120⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"121⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-