Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe
-
Size
486KB
-
MD5
fb5822b2c7ff8748337675c7caa8ffcf
-
SHA1
28c551737ecc8819c013cc9305f05695dd9072e0
-
SHA256
1b659e7fd421559318e7de11891451f986f8d2e8cd7faa5deb1bb0baaa3ea7c6
-
SHA512
fa451ebba4708fd6f04b35c1f4b9d8f64ace82673a30daac024cd425ee015cca1f9172bc50f062264cb5f8f7b80d6137807e1a41d866ad5140fe5345ae62795d
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7M9RmOdUHYMV4Nk8Xjkd2M03IY3iic8Xj3MCx:UU5rCOTeiD8oCkdJ0YY3iibfhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4112 830B.tmp 1200 83E5.tmp 1764 84B1.tmp 1008 85AB.tmp 2756 8666.tmp 5000 8702.tmp 1416 87BE.tmp 2256 886A.tmp 4516 8925.tmp 4376 89B2.tmp 2644 8AAC.tmp 1664 8B96.tmp 4044 8C32.tmp 4088 8CBF.tmp 4848 8D9A.tmp 3700 8E26.tmp 3552 8EB3.tmp 228 8F4F.tmp 4832 903A.tmp 2456 9105.tmp 3904 922E.tmp 1248 92E9.tmp 4372 9395.tmp 4860 9451.tmp 4692 94ED.tmp 768 9579.tmp 2664 9606.tmp 2508 96B2.tmp 3108 973F.tmp 4428 97DB.tmp 1452 9887.tmp 916 9971.tmp 564 9A3C.tmp 712 9AB9.tmp 4944 9B17.tmp 408 9B94.tmp 3084 9C30.tmp 4436 9CAD.tmp 4012 9D49.tmp 4192 9DC6.tmp 4840 9E43.tmp 4396 9EC0.tmp 1424 9F4D.tmp 1312 9FF9.tmp 4236 A066.tmp 4292 A0F3.tmp 5100 A180.tmp 1940 A20C.tmp 1808 A27A.tmp 532 A345.tmp 4908 A3D1.tmp 2020 A43F.tmp 2756 A4DB.tmp 1924 A558.tmp 856 A5E5.tmp 4900 A671.tmp 2860 A6EE.tmp 2360 A75C.tmp 644 A7C9.tmp 2644 A846.tmp 4084 A8E2.tmp 1648 A950.tmp 1792 A9EC.tmp 2588 AA69.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5100 wrote to memory of 4112 5100 fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe 82 PID 5100 wrote to memory of 4112 5100 fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe 82 PID 5100 wrote to memory of 4112 5100 fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe 82 PID 4112 wrote to memory of 1200 4112 830B.tmp 83 PID 4112 wrote to memory of 1200 4112 830B.tmp 83 PID 4112 wrote to memory of 1200 4112 830B.tmp 83 PID 1200 wrote to memory of 1764 1200 83E5.tmp 84 PID 1200 wrote to memory of 1764 1200 83E5.tmp 84 PID 1200 wrote to memory of 1764 1200 83E5.tmp 84 PID 1764 wrote to memory of 1008 1764 84B1.tmp 85 PID 1764 wrote to memory of 1008 1764 84B1.tmp 85 PID 1764 wrote to memory of 1008 1764 84B1.tmp 85 PID 1008 wrote to memory of 2756 1008 85AB.tmp 86 PID 1008 wrote to memory of 2756 1008 85AB.tmp 86 PID 1008 wrote to memory of 2756 1008 85AB.tmp 86 PID 2756 wrote to memory of 5000 2756 8666.tmp 87 PID 2756 wrote to memory of 5000 2756 8666.tmp 87 PID 2756 wrote to memory of 5000 2756 8666.tmp 87 PID 5000 wrote to memory of 1416 5000 8702.tmp 88 PID 5000 wrote to memory of 1416 5000 8702.tmp 88 PID 5000 wrote to memory of 1416 5000 8702.tmp 88 PID 1416 wrote to memory of 2256 1416 87BE.tmp 89 PID 1416 wrote to memory of 2256 1416 87BE.tmp 89 PID 1416 wrote to memory of 2256 1416 87BE.tmp 89 PID 2256 wrote to memory of 4516 2256 886A.tmp 90 PID 2256 wrote to memory of 4516 2256 886A.tmp 90 PID 2256 wrote to memory of 4516 2256 886A.tmp 90 PID 4516 wrote to memory of 4376 4516 8925.tmp 91 PID 4516 wrote to memory of 4376 4516 8925.tmp 91 PID 4516 wrote to memory of 4376 4516 8925.tmp 91 PID 4376 wrote to memory of 2644 4376 89B2.tmp 92 PID 4376 wrote to memory of 2644 4376 89B2.tmp 92 PID 4376 wrote to memory of 2644 4376 89B2.tmp 92 PID 2644 wrote to memory of 1664 2644 8AAC.tmp 93 PID 2644 wrote to memory of 1664 2644 8AAC.tmp 93 PID 2644 wrote to memory of 1664 2644 8AAC.tmp 93 PID 1664 wrote to memory of 4044 1664 8B96.tmp 94 PID 1664 wrote to memory of 4044 1664 8B96.tmp 94 PID 1664 wrote to memory of 4044 1664 8B96.tmp 94 PID 4044 wrote to memory of 4088 4044 8C32.tmp 95 PID 4044 wrote to memory of 4088 4044 8C32.tmp 95 PID 4044 wrote to memory of 4088 4044 8C32.tmp 95 PID 4088 wrote to memory of 4848 4088 8CBF.tmp 96 PID 4088 wrote to memory of 4848 4088 8CBF.tmp 96 PID 4088 wrote to memory of 4848 4088 8CBF.tmp 96 PID 4848 wrote to memory of 3700 4848 8D9A.tmp 97 PID 4848 wrote to memory of 3700 4848 8D9A.tmp 97 PID 4848 wrote to memory of 3700 4848 8D9A.tmp 97 PID 3700 wrote to memory of 3552 3700 8E26.tmp 98 PID 3700 wrote to memory of 3552 3700 8E26.tmp 98 PID 3700 wrote to memory of 3552 3700 8E26.tmp 98 PID 3552 wrote to memory of 228 3552 8EB3.tmp 101 PID 3552 wrote to memory of 228 3552 8EB3.tmp 101 PID 3552 wrote to memory of 228 3552 8EB3.tmp 101 PID 228 wrote to memory of 4832 228 8F4F.tmp 102 PID 228 wrote to memory of 4832 228 8F4F.tmp 102 PID 228 wrote to memory of 4832 228 8F4F.tmp 102 PID 4832 wrote to memory of 2456 4832 903A.tmp 103 PID 4832 wrote to memory of 2456 4832 903A.tmp 103 PID 4832 wrote to memory of 2456 4832 903A.tmp 103 PID 2456 wrote to memory of 3904 2456 9105.tmp 104 PID 2456 wrote to memory of 3904 2456 9105.tmp 104 PID 2456 wrote to memory of 3904 2456 9105.tmp 104 PID 3904 wrote to memory of 1248 3904 922E.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fb5822b2c7ff8748337675c7caa8ffcf_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"23⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"24⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"25⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\94ED.tmp"C:\Users\Admin\AppData\Local\Temp\94ED.tmp"26⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"27⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"28⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"29⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"30⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"31⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"32⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"33⤵
- Executes dropped EXE
PID:916 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"34⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"35⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"36⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"37⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"38⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"39⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"40⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"41⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"42⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"43⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"44⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"45⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"46⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"47⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"48⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"49⤵
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"50⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"51⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"52⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"53⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"54⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"55⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"56⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"57⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"58⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"59⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"60⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"61⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"62⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"63⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"64⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"65⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"66⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"67⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"68⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"69⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"70⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"71⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"72⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\AE70.tmp"C:\Users\Admin\AppData\Local\Temp\AE70.tmp"73⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"74⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"75⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"76⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"77⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"78⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"79⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"80⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"81⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"82⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"83⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"84⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"85⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"86⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"87⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"88⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"89⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"90⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"91⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"92⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"93⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"94⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"95⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"96⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"97⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"98⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"99⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"100⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"101⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"102⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"103⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"104⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"105⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"106⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"107⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"108⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"109⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"110⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"111⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"112⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"113⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"114⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"115⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"116⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"117⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"118⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"119⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"120⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"121⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"122⤵PID:3596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-