Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe
-
Size
520KB
-
MD5
fc2330da0dd65a6f2d1394902910d991
-
SHA1
814cede766e6f7b74deee2e035905198a26b99b7
-
SHA256
f47f46958d8c59d12deaafe399da86eccb34f725b85ce58795547700ff05a74b
-
SHA512
ffab3a97298a0fbf9daad98af204a7d4f57a23e0ddda872045017c3c65acdae3cc8a6491d65454339ef554c54818c784df5bd5075952d0e502d39c577902d784
-
SSDEEP
12288:XbB1mLVrShTQ7qwt3E5+XWNe+841+fU9dNZ:XbGLshM243Es181+f+dN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1612 739A.tmp 2604 7494.tmp 1248 7520.tmp 336 75BC.tmp 1376 7688.tmp 1848 7753.tmp 1392 783D.tmp 2768 7908.tmp 2960 79F3.tmp 4180 7A8F.tmp 4572 7B3B.tmp 3712 7C06.tmp 5032 7CA2.tmp 4384 7D8C.tmp 4396 7E67.tmp 2548 801D.tmp 1636 80C9.tmp 4160 8165.tmp 3532 8211.tmp 3316 82AD.tmp 3024 8359.tmp 4996 8405.tmp 872 84D0.tmp 4564 857C.tmp 2884 8628.tmp 2232 86B4.tmp 4804 8760.tmp 4284 881C.tmp 3516 88C7.tmp 1292 8964.tmp 3976 8A1F.tmp 1440 8B0A.tmp 4900 8BF4.tmp 1468 8C81.tmp 4992 8CFE.tmp 1160 8D7B.tmp 3052 8E07.tmp 1748 8EA3.tmp 4936 8F5F.tmp 3780 8FDC.tmp 3472 9059.tmp 1832 90F5.tmp 1108 9172.tmp 4888 91EF.tmp 4124 925D.tmp 2356 92E9.tmp 532 9376.tmp 1924 93F3.tmp 3272 9470.tmp 3832 94ED.tmp 2984 956A.tmp 2604 95D7.tmp 784 9664.tmp 1248 9710.tmp 3460 97BC.tmp 2192 9848.tmp 1588 98C5.tmp 3804 9961.tmp 1680 99CF.tmp 5052 9A5B.tmp 32 9AE8.tmp 232 9B75.tmp 4200 9BE2.tmp 3972 9C8E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1612 4376 fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe 82 PID 4376 wrote to memory of 1612 4376 fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe 82 PID 4376 wrote to memory of 1612 4376 fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe 82 PID 1612 wrote to memory of 2604 1612 739A.tmp 83 PID 1612 wrote to memory of 2604 1612 739A.tmp 83 PID 1612 wrote to memory of 2604 1612 739A.tmp 83 PID 2604 wrote to memory of 1248 2604 7494.tmp 84 PID 2604 wrote to memory of 1248 2604 7494.tmp 84 PID 2604 wrote to memory of 1248 2604 7494.tmp 84 PID 1248 wrote to memory of 336 1248 7520.tmp 85 PID 1248 wrote to memory of 336 1248 7520.tmp 85 PID 1248 wrote to memory of 336 1248 7520.tmp 85 PID 336 wrote to memory of 1376 336 75BC.tmp 86 PID 336 wrote to memory of 1376 336 75BC.tmp 86 PID 336 wrote to memory of 1376 336 75BC.tmp 86 PID 1376 wrote to memory of 1848 1376 7688.tmp 87 PID 1376 wrote to memory of 1848 1376 7688.tmp 87 PID 1376 wrote to memory of 1848 1376 7688.tmp 87 PID 1848 wrote to memory of 1392 1848 7753.tmp 88 PID 1848 wrote to memory of 1392 1848 7753.tmp 88 PID 1848 wrote to memory of 1392 1848 7753.tmp 88 PID 1392 wrote to memory of 2768 1392 783D.tmp 89 PID 1392 wrote to memory of 2768 1392 783D.tmp 89 PID 1392 wrote to memory of 2768 1392 783D.tmp 89 PID 2768 wrote to memory of 2960 2768 7908.tmp 90 PID 2768 wrote to memory of 2960 2768 7908.tmp 90 PID 2768 wrote to memory of 2960 2768 7908.tmp 90 PID 2960 wrote to memory of 4180 2960 79F3.tmp 92 PID 2960 wrote to memory of 4180 2960 79F3.tmp 92 PID 2960 wrote to memory of 4180 2960 79F3.tmp 92 PID 4180 wrote to memory of 4572 4180 7A8F.tmp 93 PID 4180 wrote to memory of 4572 4180 7A8F.tmp 93 PID 4180 wrote to memory of 4572 4180 7A8F.tmp 93 PID 4572 wrote to memory of 3712 4572 7B3B.tmp 94 PID 4572 wrote to memory of 3712 4572 7B3B.tmp 94 PID 4572 wrote to memory of 3712 4572 7B3B.tmp 94 PID 3712 wrote to memory of 5032 3712 7C06.tmp 95 PID 3712 wrote to memory of 5032 3712 7C06.tmp 95 PID 3712 wrote to memory of 5032 3712 7C06.tmp 95 PID 5032 wrote to memory of 4384 5032 7CA2.tmp 96 PID 5032 wrote to memory of 4384 5032 7CA2.tmp 96 PID 5032 wrote to memory of 4384 5032 7CA2.tmp 96 PID 4384 wrote to memory of 4396 4384 7D8C.tmp 97 PID 4384 wrote to memory of 4396 4384 7D8C.tmp 97 PID 4384 wrote to memory of 4396 4384 7D8C.tmp 97 PID 4396 wrote to memory of 2548 4396 7E67.tmp 98 PID 4396 wrote to memory of 2548 4396 7E67.tmp 98 PID 4396 wrote to memory of 2548 4396 7E67.tmp 98 PID 2548 wrote to memory of 1636 2548 801D.tmp 99 PID 2548 wrote to memory of 1636 2548 801D.tmp 99 PID 2548 wrote to memory of 1636 2548 801D.tmp 99 PID 1636 wrote to memory of 4160 1636 80C9.tmp 100 PID 1636 wrote to memory of 4160 1636 80C9.tmp 100 PID 1636 wrote to memory of 4160 1636 80C9.tmp 100 PID 4160 wrote to memory of 3532 4160 8165.tmp 103 PID 4160 wrote to memory of 3532 4160 8165.tmp 103 PID 4160 wrote to memory of 3532 4160 8165.tmp 103 PID 3532 wrote to memory of 3316 3532 8211.tmp 104 PID 3532 wrote to memory of 3316 3532 8211.tmp 104 PID 3532 wrote to memory of 3316 3532 8211.tmp 104 PID 3316 wrote to memory of 3024 3316 82AD.tmp 105 PID 3316 wrote to memory of 3024 3316 82AD.tmp 105 PID 3316 wrote to memory of 3024 3316 82AD.tmp 105 PID 3024 wrote to memory of 4996 3024 8359.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fc2330da0dd65a6f2d1394902910d991_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"23⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"24⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"25⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"26⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"27⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"28⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"29⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"30⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"31⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"32⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"33⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"34⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"35⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"36⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"37⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"38⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"39⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"40⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"41⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"42⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"43⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"44⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"45⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"46⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"47⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"48⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"49⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\9470.tmp"C:\Users\Admin\AppData\Local\Temp\9470.tmp"50⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"51⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"52⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"53⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"54⤵
- Executes dropped EXE
PID:784 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"55⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"56⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"57⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"58⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"59⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"60⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"61⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"62⤵
- Executes dropped EXE
PID:32 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"63⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"64⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"65⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"66⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"67⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"68⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"69⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"70⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"71⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"72⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"73⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"74⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"75⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"76⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"77⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"78⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"79⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"80⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"81⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"82⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"83⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"84⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"85⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"87⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"88⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"89⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"90⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"91⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"92⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"93⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"94⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"95⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"96⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"97⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"98⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"99⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"100⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"101⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"102⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"103⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"104⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"105⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"106⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"107⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"108⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"109⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"110⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"111⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"112⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"113⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"114⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"115⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"116⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"117⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"118⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"119⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"120⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"121⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"122⤵PID:3292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-