Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe
Resource
win10v2004-20230824-en
General
-
Target
a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe
-
Size
487KB
-
MD5
a8258eb2ce6fe5607ae6d484935564ef
-
SHA1
3fc538d364851deeda05093d505c37c8824375b7
-
SHA256
696cb9d804b9a43eabece0219916e0c3b8056d2b68fb32d4c4878ca368fbb02a
-
SHA512
16b4e747aa6bc3e68ede7692fbefdb592ba57ca6df5713b2f87bacd0aa9b1aaf653fc77ef8fc7583fa9a3717344a1aa70904969adec9b912fb9a95cfc24fa045
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUYjiLBwX6YrPx36o6QCQgDFZw927pre+ScDsz:HU5rCOTeiJeNoiVDs92N6htNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2580 2EBC.tmp 4912 3014.tmp 4624 30EE.tmp 1384 31D9.tmp 1760 3302.tmp 3184 342A.tmp 2512 34F6.tmp 3828 35F0.tmp 4944 37E4.tmp 3836 38AF.tmp 3700 39D8.tmp 4860 3AE1.tmp 1580 3C58.tmp 2896 3DB0.tmp 2872 3F17.tmp 1192 405F.tmp 2396 4159.tmp 2876 4263.tmp 3640 432E.tmp 4664 4438.tmp 2204 45DE.tmp 3692 47C2.tmp 4916 48EB.tmp 768 49B6.tmp 4872 4A91.tmp 1940 4B7B.tmp 1288 4C08.tmp 2484 4CD3.tmp 4420 4DFC.tmp 1120 4EE6.tmp 2920 4FB1.tmp 4304 505D.tmp 4012 5128.tmp 2772 51D4.tmp 3864 5290.tmp 4332 537A.tmp 4412 5426.tmp 3680 5501.tmp 4964 55AD.tmp 2064 56D5.tmp 3032 57B0.tmp 5104 5B4A.tmp 3440 5BC7.tmp 3000 5C83.tmp 1472 5D5D.tmp 4112 5E19.tmp 2388 5EE4.tmp 2868 5F9F.tmp 3460 605B.tmp 3080 6126.tmp 3676 61A3.tmp 64 624F.tmp 5028 62FB.tmp 2780 63D6.tmp 2132 64A1.tmp 1304 652D.tmp 4388 65AA.tmp 1332 6685.tmp 1036 677F.tmp 3216 681B.tmp 2000 6898.tmp 4768 6935.tmp 3608 6A0F.tmp 2260 6ACB.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4055F732-8E16-4956-AD71-341F836BBE89}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2580 2112 a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe 86 PID 2112 wrote to memory of 2580 2112 a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe 86 PID 2112 wrote to memory of 2580 2112 a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe 86 PID 2580 wrote to memory of 4912 2580 2EBC.tmp 87 PID 2580 wrote to memory of 4912 2580 2EBC.tmp 87 PID 2580 wrote to memory of 4912 2580 2EBC.tmp 87 PID 4912 wrote to memory of 4624 4912 3014.tmp 88 PID 4912 wrote to memory of 4624 4912 3014.tmp 88 PID 4912 wrote to memory of 4624 4912 3014.tmp 88 PID 4624 wrote to memory of 1384 4624 30EE.tmp 90 PID 4624 wrote to memory of 1384 4624 30EE.tmp 90 PID 4624 wrote to memory of 1384 4624 30EE.tmp 90 PID 1384 wrote to memory of 1760 1384 31D9.tmp 91 PID 1384 wrote to memory of 1760 1384 31D9.tmp 91 PID 1384 wrote to memory of 1760 1384 31D9.tmp 91 PID 1760 wrote to memory of 3184 1760 3302.tmp 92 PID 1760 wrote to memory of 3184 1760 3302.tmp 92 PID 1760 wrote to memory of 3184 1760 3302.tmp 92 PID 3184 wrote to memory of 2512 3184 342A.tmp 93 PID 3184 wrote to memory of 2512 3184 342A.tmp 93 PID 3184 wrote to memory of 2512 3184 342A.tmp 93 PID 2512 wrote to memory of 3828 2512 34F6.tmp 94 PID 2512 wrote to memory of 3828 2512 34F6.tmp 94 PID 2512 wrote to memory of 3828 2512 34F6.tmp 94 PID 3828 wrote to memory of 4944 3828 35F0.tmp 95 PID 3828 wrote to memory of 4944 3828 35F0.tmp 95 PID 3828 wrote to memory of 4944 3828 35F0.tmp 95 PID 4944 wrote to memory of 3836 4944 37E4.tmp 96 PID 4944 wrote to memory of 3836 4944 37E4.tmp 96 PID 4944 wrote to memory of 3836 4944 37E4.tmp 96 PID 3836 wrote to memory of 3700 3836 38AF.tmp 97 PID 3836 wrote to memory of 3700 3836 38AF.tmp 97 PID 3836 wrote to memory of 3700 3836 38AF.tmp 97 PID 3700 wrote to memory of 4860 3700 39D8.tmp 98 PID 3700 wrote to memory of 4860 3700 39D8.tmp 98 PID 3700 wrote to memory of 4860 3700 39D8.tmp 98 PID 4860 wrote to memory of 1580 4860 3AE1.tmp 99 PID 4860 wrote to memory of 1580 4860 3AE1.tmp 99 PID 4860 wrote to memory of 1580 4860 3AE1.tmp 99 PID 1580 wrote to memory of 2896 1580 3C58.tmp 100 PID 1580 wrote to memory of 2896 1580 3C58.tmp 100 PID 1580 wrote to memory of 2896 1580 3C58.tmp 100 PID 2896 wrote to memory of 2872 2896 3DB0.tmp 101 PID 2896 wrote to memory of 2872 2896 3DB0.tmp 101 PID 2896 wrote to memory of 2872 2896 3DB0.tmp 101 PID 2872 wrote to memory of 1192 2872 3F17.tmp 102 PID 2872 wrote to memory of 1192 2872 3F17.tmp 102 PID 2872 wrote to memory of 1192 2872 3F17.tmp 102 PID 1192 wrote to memory of 2396 1192 405F.tmp 103 PID 1192 wrote to memory of 2396 1192 405F.tmp 103 PID 1192 wrote to memory of 2396 1192 405F.tmp 103 PID 2396 wrote to memory of 2876 2396 4159.tmp 104 PID 2396 wrote to memory of 2876 2396 4159.tmp 104 PID 2396 wrote to memory of 2876 2396 4159.tmp 104 PID 2876 wrote to memory of 3640 2876 4263.tmp 105 PID 2876 wrote to memory of 3640 2876 4263.tmp 105 PID 2876 wrote to memory of 3640 2876 4263.tmp 105 PID 3640 wrote to memory of 4664 3640 432E.tmp 106 PID 3640 wrote to memory of 4664 3640 432E.tmp 106 PID 3640 wrote to memory of 4664 3640 432E.tmp 106 PID 4664 wrote to memory of 2204 4664 4438.tmp 107 PID 4664 wrote to memory of 2204 4664 4438.tmp 107 PID 4664 wrote to memory of 2204 4664 4438.tmp 107 PID 2204 wrote to memory of 3692 2204 45DE.tmp 108
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:2168
-
C:\Users\Admin\AppData\Local\Temp\a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\a8258eb2ce6fe5607ae6d484935564ef_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\31D9.tmp"C:\Users\Admin\AppData\Local\Temp\31D9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\4159.tmp"C:\Users\Admin\AppData\Local\Temp\4159.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\47C2.tmp"C:\Users\Admin\AppData\Local\Temp\47C2.tmp"23⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"24⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"25⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"26⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"27⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"28⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"29⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"30⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"31⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"32⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"33⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"34⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"35⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"36⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"37⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"38⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"39⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"40⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"41⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"42⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"43⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"C:\Users\Admin\AppData\Local\Temp\5BC7.tmp"44⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"45⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"46⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"47⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"48⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"49⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"50⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"51⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"52⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"53⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"54⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"55⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"56⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"57⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"58⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"59⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"60⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"61⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"62⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"63⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"64⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"65⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"66⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"67⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"68⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"69⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"70⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"71⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"72⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"73⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"74⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"75⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"76⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\748F.tmp"C:\Users\Admin\AppData\Local\Temp\748F.tmp"77⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"78⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"79⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"80⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"81⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"82⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"83⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"84⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\79FD.tmp"C:\Users\Admin\AppData\Local\Temp\79FD.tmp"85⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"86⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"87⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"88⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"89⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"90⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"91⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"92⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"93⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"94⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"95⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"96⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"97⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"98⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"99⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"100⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"101⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"102⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"103⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"104⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"105⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\873C.tmp"C:\Users\Admin\AppData\Local\Temp\873C.tmp"106⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"107⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"108⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\8901.tmp"C:\Users\Admin\AppData\Local\Temp\8901.tmp"109⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\897E.tmp"C:\Users\Admin\AppData\Local\Temp\897E.tmp"110⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"C:\Users\Admin\AppData\Local\Temp\8A1A.tmp"111⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"112⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"113⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"C:\Users\Admin\AppData\Local\Temp\8BC0.tmp"114⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"115⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"116⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"117⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\8F89.tmp"C:\Users\Admin\AppData\Local\Temp\8F89.tmp"118⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\9073.tmp"C:\Users\Admin\AppData\Local\Temp\9073.tmp"119⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"120⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"121⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\9239.tmp"C:\Users\Admin\AppData\Local\Temp\9239.tmp"122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-