Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2023, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe
-
Size
488KB
-
MD5
a1a5daf8b9b7d5684b2e1885927fdc4d
-
SHA1
f2fd3fd3247a6189ac2b6d9c510caec797783b7c
-
SHA256
3c53ee5894d76c4cb9868116d6661c538f36e854ff61c150ba8d61f29f605d7d
-
SHA512
21b5b0068f4173514fe4233b11a24bdb79ae11c42e268eaf07ff412efec8a5256b82234c6fa0419351e513f27ae157167a83eaa1fdb277110b9a7d8d2c520a23
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7x+XjtmEmUO1iY9ax5qQ8AaHEkDmdaMcp6sFl:/U5rCOTeiDYtm51iYEZ4ETAZFeuNNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1644 89A2.tmp 1460 8A1F.tmp 816 8AEA.tmp 2824 8BE4.tmp 1500 8C81.tmp 4216 8D4C.tmp 452 8DE8.tmp 1952 8E84.tmp 2780 8F30.tmp 4916 8FAD.tmp 4444 9078.tmp 1712 9124.tmp 3760 91B1.tmp 5108 92DA.tmp 412 9385.tmp 3880 9422.tmp 224 94FC.tmp 2744 95A8.tmp 552 9664.tmp 2656 971F.tmp 4600 97BC.tmp 908 9867.tmp 2936 9952.tmp 2104 9A4C.tmp 3388 9B46.tmp 1588 9C21.tmp 1144 9CDC.tmp 2080 9D88.tmp 3608 9E15.tmp 4612 9EA1.tmp 2576 9F3D.tmp 2716 A037.tmp 2488 A0F3.tmp 3080 A170.tmp 4524 A1FD.tmp 1972 A289.tmp 4204 A335.tmp 2412 A3C2.tmp 4536 A45E.tmp 3604 A4EB.tmp 2588 A596.tmp 4720 A652.tmp 468 A70D.tmp 3284 A7E8.tmp 3948 A884.tmp 3876 A930.tmp 3224 A9DC.tmp 3656 AA78.tmp 1068 AB15.tmp 1452 AB92.tmp 816 AC1E.tmp 5060 ACBB.tmp 2392 AD47.tmp 4992 ADD4.tmp 5096 AE51.tmp 1260 AEED.tmp 1060 AF89.tmp 3984 B026.tmp 988 B0A3.tmp 2780 B13F.tmp 3640 B1EB.tmp 4916 B268.tmp 4444 B2E5.tmp 1832 B371.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 1644 116 a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe 82 PID 116 wrote to memory of 1644 116 a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe 82 PID 116 wrote to memory of 1644 116 a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe 82 PID 1644 wrote to memory of 1460 1644 89A2.tmp 83 PID 1644 wrote to memory of 1460 1644 89A2.tmp 83 PID 1644 wrote to memory of 1460 1644 89A2.tmp 83 PID 1460 wrote to memory of 816 1460 8A1F.tmp 84 PID 1460 wrote to memory of 816 1460 8A1F.tmp 84 PID 1460 wrote to memory of 816 1460 8A1F.tmp 84 PID 816 wrote to memory of 2824 816 8AEA.tmp 85 PID 816 wrote to memory of 2824 816 8AEA.tmp 85 PID 816 wrote to memory of 2824 816 8AEA.tmp 85 PID 2824 wrote to memory of 1500 2824 8BE4.tmp 86 PID 2824 wrote to memory of 1500 2824 8BE4.tmp 86 PID 2824 wrote to memory of 1500 2824 8BE4.tmp 86 PID 1500 wrote to memory of 4216 1500 8C81.tmp 87 PID 1500 wrote to memory of 4216 1500 8C81.tmp 87 PID 1500 wrote to memory of 4216 1500 8C81.tmp 87 PID 4216 wrote to memory of 452 4216 8D4C.tmp 88 PID 4216 wrote to memory of 452 4216 8D4C.tmp 88 PID 4216 wrote to memory of 452 4216 8D4C.tmp 88 PID 452 wrote to memory of 1952 452 8DE8.tmp 89 PID 452 wrote to memory of 1952 452 8DE8.tmp 89 PID 452 wrote to memory of 1952 452 8DE8.tmp 89 PID 1952 wrote to memory of 2780 1952 8E84.tmp 90 PID 1952 wrote to memory of 2780 1952 8E84.tmp 90 PID 1952 wrote to memory of 2780 1952 8E84.tmp 90 PID 2780 wrote to memory of 4916 2780 8F30.tmp 91 PID 2780 wrote to memory of 4916 2780 8F30.tmp 91 PID 2780 wrote to memory of 4916 2780 8F30.tmp 91 PID 4916 wrote to memory of 4444 4916 8FAD.tmp 92 PID 4916 wrote to memory of 4444 4916 8FAD.tmp 92 PID 4916 wrote to memory of 4444 4916 8FAD.tmp 92 PID 4444 wrote to memory of 1712 4444 9078.tmp 94 PID 4444 wrote to memory of 1712 4444 9078.tmp 94 PID 4444 wrote to memory of 1712 4444 9078.tmp 94 PID 1712 wrote to memory of 3760 1712 9124.tmp 95 PID 1712 wrote to memory of 3760 1712 9124.tmp 95 PID 1712 wrote to memory of 3760 1712 9124.tmp 95 PID 3760 wrote to memory of 5108 3760 91B1.tmp 96 PID 3760 wrote to memory of 5108 3760 91B1.tmp 96 PID 3760 wrote to memory of 5108 3760 91B1.tmp 96 PID 5108 wrote to memory of 412 5108 92DA.tmp 97 PID 5108 wrote to memory of 412 5108 92DA.tmp 97 PID 5108 wrote to memory of 412 5108 92DA.tmp 97 PID 412 wrote to memory of 3880 412 9385.tmp 98 PID 412 wrote to memory of 3880 412 9385.tmp 98 PID 412 wrote to memory of 3880 412 9385.tmp 98 PID 3880 wrote to memory of 224 3880 9422.tmp 99 PID 3880 wrote to memory of 224 3880 9422.tmp 99 PID 3880 wrote to memory of 224 3880 9422.tmp 99 PID 224 wrote to memory of 2744 224 94FC.tmp 100 PID 224 wrote to memory of 2744 224 94FC.tmp 100 PID 224 wrote to memory of 2744 224 94FC.tmp 100 PID 2744 wrote to memory of 552 2744 95A8.tmp 101 PID 2744 wrote to memory of 552 2744 95A8.tmp 101 PID 2744 wrote to memory of 552 2744 95A8.tmp 101 PID 552 wrote to memory of 2656 552 9664.tmp 104 PID 552 wrote to memory of 2656 552 9664.tmp 104 PID 552 wrote to memory of 2656 552 9664.tmp 104 PID 2656 wrote to memory of 4600 2656 971F.tmp 105 PID 2656 wrote to memory of 4600 2656 971F.tmp 105 PID 2656 wrote to memory of 4600 2656 971F.tmp 105 PID 4600 wrote to memory of 908 4600 97BC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a1a5daf8b9b7d5684b2e1885927fdc4d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"23⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"24⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"25⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"26⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"27⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"28⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"29⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"30⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"31⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"32⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"33⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"34⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"35⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"36⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"37⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"38⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"39⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"40⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"41⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"42⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"43⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"44⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"45⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"46⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"47⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"48⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"49⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"50⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"51⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"52⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"53⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"54⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"55⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"56⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"57⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"58⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"59⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"60⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"61⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"62⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"63⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"64⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"65⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"66⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"67⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"68⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"69⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"70⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"71⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"72⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"73⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"74⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\B863.tmp"C:\Users\Admin\AppData\Local\Temp\B863.tmp"75⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"76⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"77⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"78⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"79⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"80⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"81⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"82⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"83⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"84⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"85⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"86⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"87⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"88⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"89⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"90⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"91⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"92⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"93⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"94⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"95⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"96⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"97⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"98⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"99⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"100⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"101⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"102⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"103⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"104⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"105⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"106⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"107⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"108⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"109⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"110⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"111⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"112⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"113⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"114⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"115⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"117⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"118⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"119⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"120⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\D08E.tmp"C:\Users\Admin\AppData\Local\Temp\D08E.tmp"121⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"122⤵PID:4932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-