Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe
-
Size
486KB
-
MD5
7aedd736f86ed25b4be158002616ca8b
-
SHA1
e0adbe6acc77f9a3eced091a77896050c284b4fe
-
SHA256
4770e0184cea6d4d230f773d9b741e4620f1c510d28aa65d88bdfb7f32d103c1
-
SHA512
050b2871842c874f00814fea07591b49508c39e3aa914bd0bb6a97aa0419e8a3eec950190a227795a38608745dc97253ed450a10cb41e4f33b3aa9dedc724396
-
SSDEEP
12288:oU5rCOTeiD8n+uhW4yQcYx79uvnRhvKwqZdNZ:oUQOJD8nZ9j6nXyjN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3452 84DF.tmp 1504 85AB.tmp 2284 8656.tmp 2240 8750.tmp 2740 87ED.tmp 1500 8889.tmp 4292 8935.tmp 2572 89D1.tmp 4140 8A5E.tmp 4252 8AFA.tmp 1400 8B87.tmp 1972 8C13.tmp 1908 8C90.tmp 2376 8CFE.tmp 4928 8D7B.tmp 3640 8E65.tmp 4664 8F30.tmp 956 8FBD.tmp 2216 9059.tmp 2720 9105.tmp 4384 91C0.tmp 2408 927C.tmp 3380 93B4.tmp 2300 9431.tmp 1556 94FC.tmp 4552 9599.tmp 1912 9654.tmp 1408 9710.tmp 3836 979C.tmp 3712 9858.tmp 4176 9933.tmp 1628 99FE.tmp 4660 9AAA.tmp 4108 9B46.tmp 2160 9BF2.tmp 980 9C7E.tmp 2220 9D1B.tmp 2152 9DC6.tmp 4676 9E53.tmp 3868 9EEF.tmp 3880 9F9B.tmp 3756 A028.tmp 1504 A0C4.tmp 1392 A131.tmp 4852 A1AE.tmp 4740 A25A.tmp 4388 A2F7.tmp 2240 A3B2.tmp 4520 A44E.tmp 544 A4FA.tmp 1184 A596.tmp 3268 A623.tmp 4940 A6B0.tmp 5068 A72D.tmp 3844 A7D9.tmp 2952 A875.tmp 4264 A911.tmp 3388 A97E.tmp 4252 AA0B.tmp 4324 AA98.tmp 948 AB44.tmp 1452 ABC1.tmp 3136 AC6C.tmp 5060 ACE9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 3452 1376 2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe 85 PID 1376 wrote to memory of 3452 1376 2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe 85 PID 1376 wrote to memory of 3452 1376 2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe 85 PID 3452 wrote to memory of 1504 3452 84DF.tmp 86 PID 3452 wrote to memory of 1504 3452 84DF.tmp 86 PID 3452 wrote to memory of 1504 3452 84DF.tmp 86 PID 1504 wrote to memory of 2284 1504 85AB.tmp 87 PID 1504 wrote to memory of 2284 1504 85AB.tmp 87 PID 1504 wrote to memory of 2284 1504 85AB.tmp 87 PID 2284 wrote to memory of 2240 2284 8656.tmp 88 PID 2284 wrote to memory of 2240 2284 8656.tmp 88 PID 2284 wrote to memory of 2240 2284 8656.tmp 88 PID 2240 wrote to memory of 2740 2240 8750.tmp 89 PID 2240 wrote to memory of 2740 2240 8750.tmp 89 PID 2240 wrote to memory of 2740 2240 8750.tmp 89 PID 2740 wrote to memory of 1500 2740 87ED.tmp 90 PID 2740 wrote to memory of 1500 2740 87ED.tmp 90 PID 2740 wrote to memory of 1500 2740 87ED.tmp 90 PID 1500 wrote to memory of 4292 1500 8889.tmp 91 PID 1500 wrote to memory of 4292 1500 8889.tmp 91 PID 1500 wrote to memory of 4292 1500 8889.tmp 91 PID 4292 wrote to memory of 2572 4292 8935.tmp 92 PID 4292 wrote to memory of 2572 4292 8935.tmp 92 PID 4292 wrote to memory of 2572 4292 8935.tmp 92 PID 2572 wrote to memory of 4140 2572 89D1.tmp 93 PID 2572 wrote to memory of 4140 2572 89D1.tmp 93 PID 2572 wrote to memory of 4140 2572 89D1.tmp 93 PID 4140 wrote to memory of 4252 4140 8A5E.tmp 94 PID 4140 wrote to memory of 4252 4140 8A5E.tmp 94 PID 4140 wrote to memory of 4252 4140 8A5E.tmp 94 PID 4252 wrote to memory of 1400 4252 8AFA.tmp 95 PID 4252 wrote to memory of 1400 4252 8AFA.tmp 95 PID 4252 wrote to memory of 1400 4252 8AFA.tmp 95 PID 1400 wrote to memory of 1972 1400 8B87.tmp 96 PID 1400 wrote to memory of 1972 1400 8B87.tmp 96 PID 1400 wrote to memory of 1972 1400 8B87.tmp 96 PID 1972 wrote to memory of 1908 1972 8C13.tmp 97 PID 1972 wrote to memory of 1908 1972 8C13.tmp 97 PID 1972 wrote to memory of 1908 1972 8C13.tmp 97 PID 1908 wrote to memory of 2376 1908 8C90.tmp 98 PID 1908 wrote to memory of 2376 1908 8C90.tmp 98 PID 1908 wrote to memory of 2376 1908 8C90.tmp 98 PID 2376 wrote to memory of 4928 2376 8CFE.tmp 99 PID 2376 wrote to memory of 4928 2376 8CFE.tmp 99 PID 2376 wrote to memory of 4928 2376 8CFE.tmp 99 PID 4928 wrote to memory of 3640 4928 8D7B.tmp 100 PID 4928 wrote to memory of 3640 4928 8D7B.tmp 100 PID 4928 wrote to memory of 3640 4928 8D7B.tmp 100 PID 3640 wrote to memory of 4664 3640 8E65.tmp 101 PID 3640 wrote to memory of 4664 3640 8E65.tmp 101 PID 3640 wrote to memory of 4664 3640 8E65.tmp 101 PID 4664 wrote to memory of 956 4664 8F30.tmp 102 PID 4664 wrote to memory of 956 4664 8F30.tmp 102 PID 4664 wrote to memory of 956 4664 8F30.tmp 102 PID 956 wrote to memory of 2216 956 8FBD.tmp 103 PID 956 wrote to memory of 2216 956 8FBD.tmp 103 PID 956 wrote to memory of 2216 956 8FBD.tmp 103 PID 2216 wrote to memory of 2720 2216 9059.tmp 105 PID 2216 wrote to memory of 2720 2216 9059.tmp 105 PID 2216 wrote to memory of 2720 2216 9059.tmp 105 PID 2720 wrote to memory of 4384 2720 9105.tmp 106 PID 2720 wrote to memory of 4384 2720 9105.tmp 106 PID 2720 wrote to memory of 4384 2720 9105.tmp 106 PID 4384 wrote to memory of 2408 4384 91C0.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_7aedd736f86ed25b4be158002616ca8b_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"23⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"24⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"25⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"26⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"27⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"28⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"29⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"30⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"31⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"32⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"33⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"34⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"35⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"36⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"37⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"38⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"39⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"40⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"41⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"42⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"43⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"44⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"45⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"46⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"47⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"48⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"49⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"50⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"51⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"52⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"53⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"54⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"55⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"56⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"57⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"58⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"59⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"60⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"61⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"62⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"63⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"64⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"65⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"66⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"67⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"68⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"69⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"70⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"71⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"72⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"73⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"74⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"75⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"76⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"77⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"78⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"79⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"80⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"81⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"82⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"83⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"84⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"85⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"86⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"87⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"88⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"89⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"90⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"91⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"92⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"93⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"94⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"95⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"96⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"97⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"98⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"99⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"100⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"101⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"102⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"103⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"104⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"105⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"106⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"107⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"108⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"109⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"110⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"111⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"112⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"113⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"114⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\C822.tmp"C:\Users\Admin\AppData\Local\Temp\C822.tmp"115⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"117⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"118⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"119⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"120⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"121⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-