Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe
-
Size
486KB
-
MD5
d0907b1d91a3de6303d8bd29a907984a
-
SHA1
32e167972adcae2dc12644c08262569a6a2eec2a
-
SHA256
c564dd130604d759e09082c7463ef85f382f7058131c123b3992cbe31a39e171
-
SHA512
a164a4e13cd0a616b631db2ef27afc78c216e2dec0cecc19c5df6170668d7eb5f69e2f826cbc9cd192612fb5cfa3cac6a2978a2559647edc71ffc8eec2d6d956
-
SSDEEP
12288:/U5rCOTeiDnjVhrro/j/DmHq6iqV+FE32p3o4XvNZ:/UQOJDnjnY/uH/+683zvN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4784 6409.tmp 1676 64A5.tmp 4044 6551.tmp 876 65FD.tmp 4268 668A.tmp 3860 6736.tmp 4372 67B3.tmp 528 683F.tmp 1652 68CC.tmp 4712 6997.tmp 552 6A43.tmp 5016 6AB0.tmp 4232 6B3D.tmp 3208 6BF8.tmp 4124 6C95.tmp 4952 6D50.tmp 368 6DCD.tmp 4444 6F35.tmp 2484 6FD1.tmp 4500 704E.tmp 1920 70EA.tmp 4744 7177.tmp 3844 7203.tmp 3464 72DE.tmp 1352 73A9.tmp 1520 7455.tmp 1296 74E2.tmp 1448 757E.tmp 1832 7668.tmp 2908 7743.tmp 3792 781E.tmp 4640 78CA.tmp 4348 79A4.tmp 1168 7A21.tmp 3632 7ABE.tmp 3740 7B3B.tmp 2492 7BC7.tmp 2488 7C54.tmp 1064 7CF0.tmp 1544 7D6D.tmp 5080 7E86.tmp 4340 7EE4.tmp 924 7F61.tmp 4796 7FEE.tmp 1676 805B.tmp 4756 80D8.tmp 4136 8155.tmp 892 81E2.tmp 644 824F.tmp 1880 82DC.tmp 4872 8368.tmp 3860 83E5.tmp 1812 8462.tmp 4440 84EF.tmp 4724 857C.tmp 1248 8628.tmp 1644 86A5.tmp 880 8731.tmp 2172 87BE.tmp 2552 882B.tmp 4260 8899.tmp 656 8925.tmp 2240 8993.tmp 4808 8A1F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1116 wrote to memory of 4784 1116 2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe 85 PID 1116 wrote to memory of 4784 1116 2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe 85 PID 1116 wrote to memory of 4784 1116 2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe 85 PID 4784 wrote to memory of 1676 4784 6409.tmp 86 PID 4784 wrote to memory of 1676 4784 6409.tmp 86 PID 4784 wrote to memory of 1676 4784 6409.tmp 86 PID 1676 wrote to memory of 4044 1676 64A5.tmp 87 PID 1676 wrote to memory of 4044 1676 64A5.tmp 87 PID 1676 wrote to memory of 4044 1676 64A5.tmp 87 PID 4044 wrote to memory of 876 4044 6551.tmp 88 PID 4044 wrote to memory of 876 4044 6551.tmp 88 PID 4044 wrote to memory of 876 4044 6551.tmp 88 PID 876 wrote to memory of 4268 876 65FD.tmp 89 PID 876 wrote to memory of 4268 876 65FD.tmp 89 PID 876 wrote to memory of 4268 876 65FD.tmp 89 PID 4268 wrote to memory of 3860 4268 668A.tmp 90 PID 4268 wrote to memory of 3860 4268 668A.tmp 90 PID 4268 wrote to memory of 3860 4268 668A.tmp 90 PID 3860 wrote to memory of 4372 3860 6736.tmp 91 PID 3860 wrote to memory of 4372 3860 6736.tmp 91 PID 3860 wrote to memory of 4372 3860 6736.tmp 91 PID 4372 wrote to memory of 528 4372 67B3.tmp 92 PID 4372 wrote to memory of 528 4372 67B3.tmp 92 PID 4372 wrote to memory of 528 4372 67B3.tmp 92 PID 528 wrote to memory of 1652 528 683F.tmp 93 PID 528 wrote to memory of 1652 528 683F.tmp 93 PID 528 wrote to memory of 1652 528 683F.tmp 93 PID 1652 wrote to memory of 4712 1652 68CC.tmp 94 PID 1652 wrote to memory of 4712 1652 68CC.tmp 94 PID 1652 wrote to memory of 4712 1652 68CC.tmp 94 PID 4712 wrote to memory of 552 4712 6997.tmp 95 PID 4712 wrote to memory of 552 4712 6997.tmp 95 PID 4712 wrote to memory of 552 4712 6997.tmp 95 PID 552 wrote to memory of 5016 552 6A43.tmp 96 PID 552 wrote to memory of 5016 552 6A43.tmp 96 PID 552 wrote to memory of 5016 552 6A43.tmp 96 PID 5016 wrote to memory of 4232 5016 6AB0.tmp 97 PID 5016 wrote to memory of 4232 5016 6AB0.tmp 97 PID 5016 wrote to memory of 4232 5016 6AB0.tmp 97 PID 4232 wrote to memory of 3208 4232 6B3D.tmp 98 PID 4232 wrote to memory of 3208 4232 6B3D.tmp 98 PID 4232 wrote to memory of 3208 4232 6B3D.tmp 98 PID 3208 wrote to memory of 4124 3208 6BF8.tmp 100 PID 3208 wrote to memory of 4124 3208 6BF8.tmp 100 PID 3208 wrote to memory of 4124 3208 6BF8.tmp 100 PID 4124 wrote to memory of 4952 4124 6C95.tmp 101 PID 4124 wrote to memory of 4952 4124 6C95.tmp 101 PID 4124 wrote to memory of 4952 4124 6C95.tmp 101 PID 4952 wrote to memory of 368 4952 6D50.tmp 102 PID 4952 wrote to memory of 368 4952 6D50.tmp 102 PID 4952 wrote to memory of 368 4952 6D50.tmp 102 PID 368 wrote to memory of 4444 368 6DCD.tmp 103 PID 368 wrote to memory of 4444 368 6DCD.tmp 103 PID 368 wrote to memory of 4444 368 6DCD.tmp 103 PID 4444 wrote to memory of 2484 4444 6F35.tmp 104 PID 4444 wrote to memory of 2484 4444 6F35.tmp 104 PID 4444 wrote to memory of 2484 4444 6F35.tmp 104 PID 2484 wrote to memory of 4500 2484 6FD1.tmp 106 PID 2484 wrote to memory of 4500 2484 6FD1.tmp 106 PID 2484 wrote to memory of 4500 2484 6FD1.tmp 106 PID 4500 wrote to memory of 1920 4500 704E.tmp 107 PID 4500 wrote to memory of 1920 4500 704E.tmp 107 PID 4500 wrote to memory of 1920 4500 704E.tmp 107 PID 1920 wrote to memory of 4744 1920 70EA.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_d0907b1d91a3de6303d8bd29a907984a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"23⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"24⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"25⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"26⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"27⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"28⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"29⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"30⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"31⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"32⤵
- Executes dropped EXE
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"33⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"34⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"35⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"36⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"37⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"38⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"39⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"40⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"41⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"42⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"43⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"44⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"45⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"46⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"47⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"48⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"49⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"50⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"51⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"52⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"53⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"55⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"56⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"57⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"58⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"59⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"60⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"61⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"62⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"63⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"64⤵
- Executes dropped EXE
PID:656 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"65⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"66⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"67⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"68⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"69⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"70⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"71⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"72⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"73⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"74⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"75⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"76⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"77⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"78⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"79⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"80⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"81⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"82⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"83⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"84⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"85⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"86⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"87⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"88⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"89⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"90⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"91⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"92⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"93⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"94⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"95⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"96⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"97⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"98⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"99⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"100⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"101⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"102⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"103⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"104⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"105⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"106⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"107⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"108⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"109⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"110⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"111⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"112⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"113⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"114⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"115⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"116⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"117⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"118⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"119⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"120⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"121⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"122⤵PID:1128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-