Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 18:03
Static task
static1
Behavioral task
behavioral1
Sample
b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe
-
Size
488KB
-
MD5
b8c5702a8f0ef23e4eeca5bbcea2743c
-
SHA1
a5431a472f7b0689aee4e5665d8e07dc90b12b63
-
SHA256
a6396654bc0a08ad874fabf1f0c51ab470f79a6ab79e87654e998d38b7b05f29
-
SHA512
9c83cd2c932585605e6ee38f12cf80c48436e422ea93c691e8514c261fec7919855423b6600ac257d53a6974b7ecafbf9f3afa0ae73a95022cd1bc291e49cacb
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7BOCc1m/2ppv89F1bGJrfvOVxo3W6mmjHe3s2:/U5rCOTeiDBOCSfpedqTvOVVBmhoNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4260 8A7D.tmp 4224 8B38.tmp 4024 8C04.tmp 1212 8D0D.tmp 2820 8DF8.tmp 1420 8E84.tmp 2848 8F4F.tmp 1284 8FEC.tmp 5012 90D6.tmp 3580 9182.tmp 2188 924D.tmp 5068 9357.tmp 3916 9412.tmp 4756 948F.tmp 3980 955A.tmp 1996 95D7.tmp 5088 96B2.tmp 3540 97DB.tmp 2184 9887.tmp 4112 9913.tmp 4428 99DE.tmp 2000 9A8A.tmp 776 9B27.tmp 4912 9BC3.tmp 3260 9C6F.tmp 636 9D1B.tmp 4168 9DF5.tmp 2560 9EB1.tmp 3744 9F6C.tmp 4416 A047.tmp 4404 A122.tmp 4508 A1DD.tmp 2248 A27A.tmp 2476 A316.tmp 4628 A3C2.tmp 5028 A44E.tmp 1216 A4EB.tmp 3068 A596.tmp 4020 A623.tmp 3312 A6A0.tmp 1772 A74C.tmp 1872 A7E8.tmp 4772 A894.tmp 560 A921.tmp 3704 A9AD.tmp 1360 AA59.tmp 2948 AAD6.tmp 1396 AB72.tmp 4072 AC2E.tmp 4108 ACBB.tmp 1712 AD38.tmp 5064 ADC4.tmp 668 AE41.tmp 2308 AEED.tmp 4604 AF89.tmp 3840 B006.tmp 2396 B0B2.tmp 1088 B14E.tmp 3320 B1CB.tmp 4488 B248.tmp 4440 B2C5.tmp 672 B333.tmp 3760 B3A0.tmp 3008 B3FE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1556 wrote to memory of 4260 1556 b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe 83 PID 1556 wrote to memory of 4260 1556 b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe 83 PID 1556 wrote to memory of 4260 1556 b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe 83 PID 4260 wrote to memory of 4224 4260 8A7D.tmp 84 PID 4260 wrote to memory of 4224 4260 8A7D.tmp 84 PID 4260 wrote to memory of 4224 4260 8A7D.tmp 84 PID 4224 wrote to memory of 4024 4224 8B38.tmp 85 PID 4224 wrote to memory of 4024 4224 8B38.tmp 85 PID 4224 wrote to memory of 4024 4224 8B38.tmp 85 PID 4024 wrote to memory of 1212 4024 8C04.tmp 86 PID 4024 wrote to memory of 1212 4024 8C04.tmp 86 PID 4024 wrote to memory of 1212 4024 8C04.tmp 86 PID 1212 wrote to memory of 2820 1212 8D0D.tmp 87 PID 1212 wrote to memory of 2820 1212 8D0D.tmp 87 PID 1212 wrote to memory of 2820 1212 8D0D.tmp 87 PID 2820 wrote to memory of 1420 2820 8DF8.tmp 88 PID 2820 wrote to memory of 1420 2820 8DF8.tmp 88 PID 2820 wrote to memory of 1420 2820 8DF8.tmp 88 PID 1420 wrote to memory of 2848 1420 8E84.tmp 89 PID 1420 wrote to memory of 2848 1420 8E84.tmp 89 PID 1420 wrote to memory of 2848 1420 8E84.tmp 89 PID 2848 wrote to memory of 1284 2848 8F4F.tmp 90 PID 2848 wrote to memory of 1284 2848 8F4F.tmp 90 PID 2848 wrote to memory of 1284 2848 8F4F.tmp 90 PID 1284 wrote to memory of 5012 1284 8FEC.tmp 91 PID 1284 wrote to memory of 5012 1284 8FEC.tmp 91 PID 1284 wrote to memory of 5012 1284 8FEC.tmp 91 PID 5012 wrote to memory of 3580 5012 90D6.tmp 92 PID 5012 wrote to memory of 3580 5012 90D6.tmp 92 PID 5012 wrote to memory of 3580 5012 90D6.tmp 92 PID 3580 wrote to memory of 2188 3580 9182.tmp 93 PID 3580 wrote to memory of 2188 3580 9182.tmp 93 PID 3580 wrote to memory of 2188 3580 9182.tmp 93 PID 2188 wrote to memory of 5068 2188 924D.tmp 94 PID 2188 wrote to memory of 5068 2188 924D.tmp 94 PID 2188 wrote to memory of 5068 2188 924D.tmp 94 PID 5068 wrote to memory of 3916 5068 9357.tmp 95 PID 5068 wrote to memory of 3916 5068 9357.tmp 95 PID 5068 wrote to memory of 3916 5068 9357.tmp 95 PID 3916 wrote to memory of 4756 3916 9412.tmp 96 PID 3916 wrote to memory of 4756 3916 9412.tmp 96 PID 3916 wrote to memory of 4756 3916 9412.tmp 96 PID 4756 wrote to memory of 3980 4756 948F.tmp 97 PID 4756 wrote to memory of 3980 4756 948F.tmp 97 PID 4756 wrote to memory of 3980 4756 948F.tmp 97 PID 3980 wrote to memory of 1996 3980 955A.tmp 100 PID 3980 wrote to memory of 1996 3980 955A.tmp 100 PID 3980 wrote to memory of 1996 3980 955A.tmp 100 PID 1996 wrote to memory of 5088 1996 95D7.tmp 101 PID 1996 wrote to memory of 5088 1996 95D7.tmp 101 PID 1996 wrote to memory of 5088 1996 95D7.tmp 101 PID 5088 wrote to memory of 3540 5088 96B2.tmp 102 PID 5088 wrote to memory of 3540 5088 96B2.tmp 102 PID 5088 wrote to memory of 3540 5088 96B2.tmp 102 PID 3540 wrote to memory of 2184 3540 97DB.tmp 103 PID 3540 wrote to memory of 2184 3540 97DB.tmp 103 PID 3540 wrote to memory of 2184 3540 97DB.tmp 103 PID 2184 wrote to memory of 4112 2184 9887.tmp 104 PID 2184 wrote to memory of 4112 2184 9887.tmp 104 PID 2184 wrote to memory of 4112 2184 9887.tmp 104 PID 4112 wrote to memory of 4428 4112 9913.tmp 105 PID 4112 wrote to memory of 4428 4112 9913.tmp 105 PID 4112 wrote to memory of 4428 4112 9913.tmp 105 PID 4428 wrote to memory of 2000 4428 99DE.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\b8c5702a8f0ef23e4eeca5bbcea2743c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"23⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"24⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"25⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"26⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"27⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"28⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"29⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"30⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"31⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"32⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"33⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"34⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"35⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"36⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"37⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"38⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"39⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"40⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"41⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"42⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"43⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"44⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"45⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"46⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"47⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"48⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"49⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"50⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"51⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"52⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"53⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"54⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"55⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"56⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"57⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"58⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"59⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"60⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"61⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"62⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"63⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"64⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"65⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"66⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"67⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"68⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"69⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"70⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"71⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"72⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"73⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"74⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"75⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"76⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"77⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"78⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"79⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"80⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"81⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"82⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"83⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"84⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"85⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"86⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"87⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"88⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"89⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"90⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"91⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"92⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"93⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"94⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"95⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"96⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"97⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"98⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"99⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"100⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"101⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"102⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"103⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"104⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"105⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"106⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"107⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"C:\Users\Admin\AppData\Local\Temp\CAD2.tmp"108⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"109⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"110⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"111⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"112⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"113⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"114⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"115⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"116⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"C:\Users\Admin\AppData\Local\Temp\CFE3.tmp"117⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"118⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"119⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"120⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"121⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"122⤵PID:4228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-