Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
bea2df49111292b898a549e39db9d690_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bea2df49111292b898a549e39db9d690_mafia_JC.exe
Resource
win10v2004-20230824-en
General
-
Target
bea2df49111292b898a549e39db9d690_mafia_JC.exe
-
Size
486KB
-
MD5
bea2df49111292b898a549e39db9d690
-
SHA1
9da263fc9877c9c19014ae96923dfda9273ca174
-
SHA256
1ca409f3bea2c94f44871ac74fe268887633c132dfb39966ac30c89568d4ae62
-
SHA512
2ca992964f6d05ca66d224859d24ed42654b55bf25fe72eb55236cca513eb918e06e1b5937eefcceef789b012c1f906f642b26d8458dfa6c1bdcb6dcfb26a05b
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7wOS+wh2dGdEnCLvueFudlzeCmxxZ+Lfwu2pp:oU5rCOTeiDwOS+whUfC1F/CyxbhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1160 F2EB.tmp 3328 F405.tmp 4460 F4C0.tmp 2900 F57C.tmp 5048 F627.tmp 5016 F6F3.tmp 1284 143.tmp 4868 22E.tmp 3960 2D9.tmp 4652 3A5.tmp 4684 441.tmp 3620 50C.tmp 1704 5D7.tmp 1256 673.tmp 4596 75E.tmp 3976 7FA.tmp 728 8A6.tmp 2256 981.tmp 4916 A6B.tmp 3916 B55.tmp 1936 C7E.tmp 2864 D2A.tmp 3528 E05.tmp 1260 EC0.tmp 1196 F8B.tmp 3324 1047.tmp 3360 10D4.tmp 2664 1170.tmp 208 122B.tmp 4232 12D7.tmp 4264 1393.tmp 4140 148D.tmp 4220 1567.tmp 1948 15F4.tmp 560 1690.tmp 4368 177B.tmp 3628 1817.tmp 4752 195F.tmp 4680 1A1B.tmp 2592 1AC6.tmp 844 1B63.tmp 2896 1BE0.tmp 2920 1D37.tmp 2108 1DB4.tmp 2148 1E41.tmp 2584 1EDD.tmp 1136 1F89.tmp 3680 2045.tmp 4460 20E1.tmp 4732 216E.tmp 3684 2277.tmp 4360 2304.tmp 5116 2371.tmp 4628 23EE.tmp 1432 24B9.tmp 4868 2546.tmp 5104 25C3.tmp 4160 266F.tmp 3512 26FB.tmp 3404 2788.tmp 3176 2853.tmp 2480 28D0.tmp 3188 298C.tmp 4560 2A28.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A9437172-3A39-4AAD-B62D-3148AE192AE8}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1160 2148 bea2df49111292b898a549e39db9d690_mafia_JC.exe 85 PID 2148 wrote to memory of 1160 2148 bea2df49111292b898a549e39db9d690_mafia_JC.exe 85 PID 2148 wrote to memory of 1160 2148 bea2df49111292b898a549e39db9d690_mafia_JC.exe 85 PID 1160 wrote to memory of 3328 1160 F2EB.tmp 86 PID 1160 wrote to memory of 3328 1160 F2EB.tmp 86 PID 1160 wrote to memory of 3328 1160 F2EB.tmp 86 PID 3328 wrote to memory of 4460 3328 F405.tmp 87 PID 3328 wrote to memory of 4460 3328 F405.tmp 87 PID 3328 wrote to memory of 4460 3328 F405.tmp 87 PID 4460 wrote to memory of 2900 4460 F4C0.tmp 88 PID 4460 wrote to memory of 2900 4460 F4C0.tmp 88 PID 4460 wrote to memory of 2900 4460 F4C0.tmp 88 PID 2900 wrote to memory of 5048 2900 F57C.tmp 89 PID 2900 wrote to memory of 5048 2900 F57C.tmp 89 PID 2900 wrote to memory of 5048 2900 F57C.tmp 89 PID 5048 wrote to memory of 5016 5048 F627.tmp 90 PID 5048 wrote to memory of 5016 5048 F627.tmp 90 PID 5048 wrote to memory of 5016 5048 F627.tmp 90 PID 5016 wrote to memory of 1284 5016 F6F3.tmp 92 PID 5016 wrote to memory of 1284 5016 F6F3.tmp 92 PID 5016 wrote to memory of 1284 5016 F6F3.tmp 92 PID 1284 wrote to memory of 4868 1284 143.tmp 93 PID 1284 wrote to memory of 4868 1284 143.tmp 93 PID 1284 wrote to memory of 4868 1284 143.tmp 93 PID 4868 wrote to memory of 3960 4868 22E.tmp 94 PID 4868 wrote to memory of 3960 4868 22E.tmp 94 PID 4868 wrote to memory of 3960 4868 22E.tmp 94 PID 3960 wrote to memory of 4652 3960 2D9.tmp 95 PID 3960 wrote to memory of 4652 3960 2D9.tmp 95 PID 3960 wrote to memory of 4652 3960 2D9.tmp 95 PID 4652 wrote to memory of 4684 4652 3A5.tmp 96 PID 4652 wrote to memory of 4684 4652 3A5.tmp 96 PID 4652 wrote to memory of 4684 4652 3A5.tmp 96 PID 4684 wrote to memory of 3620 4684 441.tmp 98 PID 4684 wrote to memory of 3620 4684 441.tmp 98 PID 4684 wrote to memory of 3620 4684 441.tmp 98 PID 3620 wrote to memory of 1704 3620 50C.tmp 99 PID 3620 wrote to memory of 1704 3620 50C.tmp 99 PID 3620 wrote to memory of 1704 3620 50C.tmp 99 PID 1704 wrote to memory of 1256 1704 5D7.tmp 100 PID 1704 wrote to memory of 1256 1704 5D7.tmp 100 PID 1704 wrote to memory of 1256 1704 5D7.tmp 100 PID 1256 wrote to memory of 4596 1256 673.tmp 101 PID 1256 wrote to memory of 4596 1256 673.tmp 101 PID 1256 wrote to memory of 4596 1256 673.tmp 101 PID 4596 wrote to memory of 3976 4596 75E.tmp 102 PID 4596 wrote to memory of 3976 4596 75E.tmp 102 PID 4596 wrote to memory of 3976 4596 75E.tmp 102 PID 3976 wrote to memory of 728 3976 7FA.tmp 103 PID 3976 wrote to memory of 728 3976 7FA.tmp 103 PID 3976 wrote to memory of 728 3976 7FA.tmp 103 PID 728 wrote to memory of 2256 728 8A6.tmp 104 PID 728 wrote to memory of 2256 728 8A6.tmp 104 PID 728 wrote to memory of 2256 728 8A6.tmp 104 PID 2256 wrote to memory of 4916 2256 981.tmp 105 PID 2256 wrote to memory of 4916 2256 981.tmp 105 PID 2256 wrote to memory of 4916 2256 981.tmp 105 PID 4916 wrote to memory of 3916 4916 A6B.tmp 106 PID 4916 wrote to memory of 3916 4916 A6B.tmp 106 PID 4916 wrote to memory of 3916 4916 A6B.tmp 106 PID 3916 wrote to memory of 1936 3916 B55.tmp 107 PID 3916 wrote to memory of 1936 3916 B55.tmp 107 PID 3916 wrote to memory of 1936 3916 B55.tmp 107 PID 1936 wrote to memory of 2864 1936 C7E.tmp 108
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:1408
-
C:\Users\Admin\AppData\Local\Temp\bea2df49111292b898a549e39db9d690_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bea2df49111292b898a549e39db9d690_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D2A.tmp"C:\Users\Admin\AppData\Local\Temp\D2A.tmp"23⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"24⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"25⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"26⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"27⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"28⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"29⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"30⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"31⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"32⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"33⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"34⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"35⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"36⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"37⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\1817.tmp"C:\Users\Admin\AppData\Local\Temp\1817.tmp"38⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\195F.tmp"C:\Users\Admin\AppData\Local\Temp\195F.tmp"39⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"40⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"41⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"42⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"43⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"44⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"45⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"46⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"47⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"48⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"49⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"50⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"51⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"52⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"53⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"54⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"55⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"56⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"57⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"58⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\25C3.tmp"C:\Users\Admin\AppData\Local\Temp\25C3.tmp"59⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"60⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\26FB.tmp"C:\Users\Admin\AppData\Local\Temp\26FB.tmp"61⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"62⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"63⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"64⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"65⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"66⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"67⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"68⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"69⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"70⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"71⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"72⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"73⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"C:\Users\Admin\AppData\Local\Temp\2EAC.tmp"74⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"75⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"76⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"77⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"78⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"79⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"80⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"81⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\337F.tmp"C:\Users\Admin\AppData\Local\Temp\337F.tmp"82⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"83⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"84⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"85⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"86⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"87⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"88⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"89⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"90⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"91⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"92⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"93⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"94⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"95⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"96⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"97⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"98⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"99⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"100⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"101⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"102⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"103⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"104⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"105⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"106⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"107⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"108⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"109⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"110⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\4580.tmp"C:\Users\Admin\AppData\Local\Temp\4580.tmp"111⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\461C.tmp"C:\Users\Admin\AppData\Local\Temp\461C.tmp"112⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\46A9.tmp"C:\Users\Admin\AppData\Local\Temp\46A9.tmp"113⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"114⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"115⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"116⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"117⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"118⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"119⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"120⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"121⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-