Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 16:03
Static task
static1
Behavioral task
behavioral1
Sample
bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe
-
Size
487KB
-
MD5
bdc11f269d934b20a2ceb0dc41bc192a
-
SHA1
3773ca0d9df4401d6f93e3845f68cea429e6f318
-
SHA256
4fc4c863f6dd1e0cabb724ccefa6e390d85db285d42e9bdfc38ac2c0f2e9350e
-
SHA512
49bbf9bf0a1a78433d8d0f048128769a6ae4948eb42215ee20323d8df728e08a53911631ddd77a155653450079cb00ff7b6831f76ff31ac2f6a2bb982cbb8142
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxz1EexhPlSGX/xrG3yPNM2B2S7CYGUnyBsH39:yU5rCOTeiNtJxhPlSGPM3T2MYfZbZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4404 76E5.tmp 3528 7791.tmp 2488 781E.tmp 4656 78CA.tmp 2200 7976.tmp 1084 7A41.tmp 3128 7ADD.tmp 2340 7B79.tmp 2728 7C54.tmp 2260 7CF0.tmp 3976 7DAC.tmp 2396 7E58.tmp 8 7F32.tmp 4200 7FFD.tmp 4252 808A.tmp 4192 81B3.tmp 2572 8230.tmp 2868 82DC.tmp 4732 8388.tmp 4128 8405.tmp 1044 84C0.tmp 3776 855C.tmp 4976 8685.tmp 4888 8760.tmp 4172 87DD.tmp 3868 886A.tmp 4508 8906.tmp 4472 8993.tmp 4624 8A1F.tmp 3228 8AFA.tmp 4600 8BC5.tmp 928 8C90.tmp 2584 8D1D.tmp 3040 8DA9.tmp 1868 8E17.tmp 2988 8EC3.tmp 1092 8F4F.tmp 5076 8FCC.tmp 3504 9049.tmp 4212 90B7.tmp 2080 9153.tmp 4492 91EF.tmp 4340 926C.tmp 60 92CA.tmp 4392 9366.tmp 3524 93E3.tmp 4176 9451.tmp 4188 94DD.tmp 4380 956A.tmp 4376 95E7.tmp 4384 9683.tmp 4156 9710.tmp 3484 97AC.tmp 2252 9848.tmp 4240 98D5.tmp 2200 9961.tmp 2708 99CF.tmp 4364 9A5B.tmp 4952 9AC9.tmp 1808 9B55.tmp 4840 9BD2.tmp 1484 9C4F.tmp 1036 9CBD.tmp 1372 9D2A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 4404 4688 bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe 83 PID 4688 wrote to memory of 4404 4688 bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe 83 PID 4688 wrote to memory of 4404 4688 bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe 83 PID 4404 wrote to memory of 3528 4404 76E5.tmp 84 PID 4404 wrote to memory of 3528 4404 76E5.tmp 84 PID 4404 wrote to memory of 3528 4404 76E5.tmp 84 PID 3528 wrote to memory of 2488 3528 7791.tmp 85 PID 3528 wrote to memory of 2488 3528 7791.tmp 85 PID 3528 wrote to memory of 2488 3528 7791.tmp 85 PID 2488 wrote to memory of 4656 2488 781E.tmp 86 PID 2488 wrote to memory of 4656 2488 781E.tmp 86 PID 2488 wrote to memory of 4656 2488 781E.tmp 86 PID 4656 wrote to memory of 2200 4656 78CA.tmp 87 PID 4656 wrote to memory of 2200 4656 78CA.tmp 87 PID 4656 wrote to memory of 2200 4656 78CA.tmp 87 PID 2200 wrote to memory of 1084 2200 7976.tmp 88 PID 2200 wrote to memory of 1084 2200 7976.tmp 88 PID 2200 wrote to memory of 1084 2200 7976.tmp 88 PID 1084 wrote to memory of 3128 1084 7A41.tmp 89 PID 1084 wrote to memory of 3128 1084 7A41.tmp 89 PID 1084 wrote to memory of 3128 1084 7A41.tmp 89 PID 3128 wrote to memory of 2340 3128 7ADD.tmp 91 PID 3128 wrote to memory of 2340 3128 7ADD.tmp 91 PID 3128 wrote to memory of 2340 3128 7ADD.tmp 91 PID 2340 wrote to memory of 2728 2340 7B79.tmp 92 PID 2340 wrote to memory of 2728 2340 7B79.tmp 92 PID 2340 wrote to memory of 2728 2340 7B79.tmp 92 PID 2728 wrote to memory of 2260 2728 7C54.tmp 93 PID 2728 wrote to memory of 2260 2728 7C54.tmp 93 PID 2728 wrote to memory of 2260 2728 7C54.tmp 93 PID 2260 wrote to memory of 3976 2260 7CF0.tmp 94 PID 2260 wrote to memory of 3976 2260 7CF0.tmp 94 PID 2260 wrote to memory of 3976 2260 7CF0.tmp 94 PID 3976 wrote to memory of 2396 3976 7DAC.tmp 95 PID 3976 wrote to memory of 2396 3976 7DAC.tmp 95 PID 3976 wrote to memory of 2396 3976 7DAC.tmp 95 PID 2396 wrote to memory of 8 2396 7E58.tmp 96 PID 2396 wrote to memory of 8 2396 7E58.tmp 96 PID 2396 wrote to memory of 8 2396 7E58.tmp 96 PID 8 wrote to memory of 4200 8 7F32.tmp 97 PID 8 wrote to memory of 4200 8 7F32.tmp 97 PID 8 wrote to memory of 4200 8 7F32.tmp 97 PID 4200 wrote to memory of 4252 4200 7FFD.tmp 98 PID 4200 wrote to memory of 4252 4200 7FFD.tmp 98 PID 4200 wrote to memory of 4252 4200 7FFD.tmp 98 PID 4252 wrote to memory of 4192 4252 808A.tmp 99 PID 4252 wrote to memory of 4192 4252 808A.tmp 99 PID 4252 wrote to memory of 4192 4252 808A.tmp 99 PID 4192 wrote to memory of 2572 4192 81B3.tmp 101 PID 4192 wrote to memory of 2572 4192 81B3.tmp 101 PID 4192 wrote to memory of 2572 4192 81B3.tmp 101 PID 2572 wrote to memory of 2868 2572 8230.tmp 103 PID 2572 wrote to memory of 2868 2572 8230.tmp 103 PID 2572 wrote to memory of 2868 2572 8230.tmp 103 PID 2868 wrote to memory of 4732 2868 82DC.tmp 104 PID 2868 wrote to memory of 4732 2868 82DC.tmp 104 PID 2868 wrote to memory of 4732 2868 82DC.tmp 104 PID 4732 wrote to memory of 4128 4732 8388.tmp 105 PID 4732 wrote to memory of 4128 4732 8388.tmp 105 PID 4732 wrote to memory of 4128 4732 8388.tmp 105 PID 4128 wrote to memory of 1044 4128 8405.tmp 106 PID 4128 wrote to memory of 1044 4128 8405.tmp 106 PID 4128 wrote to memory of 1044 4128 8405.tmp 106 PID 1044 wrote to memory of 3776 1044 84C0.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bdc11f269d934b20a2ceb0dc41bc192a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"23⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"24⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"25⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"26⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"27⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"28⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"29⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"30⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"31⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"32⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"33⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"34⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"35⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"36⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"37⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"38⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"39⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"40⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"41⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"42⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"43⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"44⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"45⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"46⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"47⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"48⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"49⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"50⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"51⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"52⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"53⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"54⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"55⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"56⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"57⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"58⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"59⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"60⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"61⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"62⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"63⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"64⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"65⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"66⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"67⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"68⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"69⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"70⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"71⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"72⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"73⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"74⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"75⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"76⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"78⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"79⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"80⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"81⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"82⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"83⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"85⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"86⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"87⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"88⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"89⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"90⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"92⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"93⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\AB92.tmp"C:\Users\Admin\AppData\Local\Temp\AB92.tmp"94⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"95⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"96⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"97⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"98⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"99⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"100⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"101⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"102⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"103⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"104⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"105⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"106⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"107⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"108⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"109⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"110⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"111⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"112⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"113⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"114⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\B640.tmp"C:\Users\Admin\AppData\Local\Temp\B640.tmp"115⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"116⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"117⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"118⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"120⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"121⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"122⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-