Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe
-
Size
486KB
-
MD5
37ba216edd5cae1836a029871e24da8c
-
SHA1
a48a605ff8d1f66bbafbcc9121e4cf3212c5013d
-
SHA256
88402e1b5da3983b099c2a9bc18da7644ebcff58efa0fd05f6a2eb06c2a1369a
-
SHA512
e24929b906e670923ce36a084015ceeea52759c523c54fb706ee8609d88c03c92a093ff4cd4a48dfd2623f405a66330139cc280e886db44d4cf0f90add8e04af
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7NYeDMQO9pv/u+zjOIQC4prYf147pTDK5nWsz:oU5rCOTeiDN2rv5WIL4K99NnNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5036 6CF2.tmp 2968 6DAE.tmp 4072 7261.tmp 4344 731D.tmp 4348 73B9.tmp 1316 7465.tmp 3472 7520.tmp 2292 759D.tmp 1104 762A.tmp 1572 76D6.tmp 1212 7772.tmp 1852 780E.tmp 5000 78CA.tmp 4128 7985.tmp 1384 7A21.tmp 1468 7AED.tmp 2352 7B5A.tmp 1780 7C06.tmp 3312 7CA2.tmp 4196 7D4E.tmp 1492 7E19.tmp 460 7EF4.tmp 2840 7FDE.tmp 4220 80A9.tmp 5084 8155.tmp 1868 824F.tmp 2192 830B.tmp 2800 8405.tmp 4176 84C0.tmp 3376 857C.tmp 1452 8618.tmp 1612 86E3.tmp 2236 879F.tmp 2184 883B.tmp 5104 88D7.tmp 4852 8973.tmp 1776 8A2F.tmp 4624 8ABB.tmp 4012 8B58.tmp 224 8BF4.tmp 3652 8CCF.tmp 228 8D4C.tmp 5096 8DD8.tmp 1228 8E75.tmp 1488 8F01.tmp 2176 8F7E.tmp 3804 900B.tmp 1284 9097.tmp 4336 9114.tmp 456 9191.tmp 4976 921E.tmp 3760 92BA.tmp 1704 9337.tmp 4620 93B4.tmp 1996 9460.tmp 4348 94DD.tmp 1552 955A.tmp 4160 95C8.tmp 2280 9654.tmp 4960 96D1.tmp 3420 974E.tmp 1104 97BC.tmp 1572 9858.tmp 1948 98E4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 5036 4712 2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe 84 PID 4712 wrote to memory of 5036 4712 2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe 84 PID 4712 wrote to memory of 5036 4712 2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe 84 PID 5036 wrote to memory of 2968 5036 6CF2.tmp 86 PID 5036 wrote to memory of 2968 5036 6CF2.tmp 86 PID 5036 wrote to memory of 2968 5036 6CF2.tmp 86 PID 2968 wrote to memory of 4072 2968 6DAE.tmp 87 PID 2968 wrote to memory of 4072 2968 6DAE.tmp 87 PID 2968 wrote to memory of 4072 2968 6DAE.tmp 87 PID 4072 wrote to memory of 4344 4072 7261.tmp 88 PID 4072 wrote to memory of 4344 4072 7261.tmp 88 PID 4072 wrote to memory of 4344 4072 7261.tmp 88 PID 4344 wrote to memory of 4348 4344 731D.tmp 89 PID 4344 wrote to memory of 4348 4344 731D.tmp 89 PID 4344 wrote to memory of 4348 4344 731D.tmp 89 PID 4348 wrote to memory of 1316 4348 73B9.tmp 90 PID 4348 wrote to memory of 1316 4348 73B9.tmp 90 PID 4348 wrote to memory of 1316 4348 73B9.tmp 90 PID 1316 wrote to memory of 3472 1316 7465.tmp 91 PID 1316 wrote to memory of 3472 1316 7465.tmp 91 PID 1316 wrote to memory of 3472 1316 7465.tmp 91 PID 3472 wrote to memory of 2292 3472 7520.tmp 92 PID 3472 wrote to memory of 2292 3472 7520.tmp 92 PID 3472 wrote to memory of 2292 3472 7520.tmp 92 PID 2292 wrote to memory of 1104 2292 759D.tmp 93 PID 2292 wrote to memory of 1104 2292 759D.tmp 93 PID 2292 wrote to memory of 1104 2292 759D.tmp 93 PID 1104 wrote to memory of 1572 1104 762A.tmp 94 PID 1104 wrote to memory of 1572 1104 762A.tmp 94 PID 1104 wrote to memory of 1572 1104 762A.tmp 94 PID 1572 wrote to memory of 1212 1572 76D6.tmp 95 PID 1572 wrote to memory of 1212 1572 76D6.tmp 95 PID 1572 wrote to memory of 1212 1572 76D6.tmp 95 PID 1212 wrote to memory of 1852 1212 7772.tmp 97 PID 1212 wrote to memory of 1852 1212 7772.tmp 97 PID 1212 wrote to memory of 1852 1212 7772.tmp 97 PID 1852 wrote to memory of 5000 1852 780E.tmp 98 PID 1852 wrote to memory of 5000 1852 780E.tmp 98 PID 1852 wrote to memory of 5000 1852 780E.tmp 98 PID 5000 wrote to memory of 4128 5000 78CA.tmp 99 PID 5000 wrote to memory of 4128 5000 78CA.tmp 99 PID 5000 wrote to memory of 4128 5000 78CA.tmp 99 PID 4128 wrote to memory of 1384 4128 7985.tmp 100 PID 4128 wrote to memory of 1384 4128 7985.tmp 100 PID 4128 wrote to memory of 1384 4128 7985.tmp 100 PID 1384 wrote to memory of 1468 1384 7A21.tmp 102 PID 1384 wrote to memory of 1468 1384 7A21.tmp 102 PID 1384 wrote to memory of 1468 1384 7A21.tmp 102 PID 1468 wrote to memory of 2352 1468 7AED.tmp 103 PID 1468 wrote to memory of 2352 1468 7AED.tmp 103 PID 1468 wrote to memory of 2352 1468 7AED.tmp 103 PID 2352 wrote to memory of 1780 2352 7B5A.tmp 104 PID 2352 wrote to memory of 1780 2352 7B5A.tmp 104 PID 2352 wrote to memory of 1780 2352 7B5A.tmp 104 PID 1780 wrote to memory of 3312 1780 7C06.tmp 105 PID 1780 wrote to memory of 3312 1780 7C06.tmp 105 PID 1780 wrote to memory of 3312 1780 7C06.tmp 105 PID 3312 wrote to memory of 4196 3312 7CA2.tmp 106 PID 3312 wrote to memory of 4196 3312 7CA2.tmp 106 PID 3312 wrote to memory of 4196 3312 7CA2.tmp 106 PID 4196 wrote to memory of 1492 4196 7D4E.tmp 107 PID 4196 wrote to memory of 1492 4196 7D4E.tmp 107 PID 4196 wrote to memory of 1492 4196 7D4E.tmp 107 PID 1492 wrote to memory of 460 1492 7E19.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_37ba216edd5cae1836a029871e24da8c_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"23⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"24⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"25⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"26⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"27⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"28⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"29⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"30⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"31⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"32⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"33⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"34⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"35⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"36⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"37⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"38⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"39⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"40⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"41⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"42⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"43⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"44⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"45⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"46⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"47⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"48⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"49⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"50⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"51⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"52⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"53⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"54⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"55⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"56⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"57⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"58⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"59⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"60⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"61⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"62⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"63⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"64⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"65⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"66⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"67⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"68⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"69⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"70⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"71⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"72⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"73⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"74⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"75⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"76⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"77⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"78⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"79⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"80⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"81⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"83⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"84⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"85⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"86⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"87⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"88⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"89⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"90⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"91⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"92⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"94⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"95⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"96⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"97⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"98⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"99⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"100⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"101⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"102⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"103⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"104⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"105⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"106⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"107⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"108⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"109⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"110⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"111⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"112⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"113⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"114⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"115⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"116⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"117⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"118⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"119⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"120⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"121⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"122⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-