Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe
-
Size
487KB
-
MD5
d487340e058308d747b231d4fe14a2d3
-
SHA1
837605409bdfe6333c9d768ae84b6b7ef24ca3a8
-
SHA256
264b1df49313f0c480524cf14bd75550b7e3db2a9d04ba871d18eb94e8c100b3
-
SHA512
a4183a4a84da362c2c5360eed820abfb122530639b86da916c2240a4fc1d32ed29b2dfee2c3d06b42f22858de4da50d7e8c5b1897fa1d8d2423eb2e3551cee2e
-
SSDEEP
12288:yU5rCOTeiNGGsN52tHf9ki1kAwIiiRObZ:yUQOJNGGOIl31Dgb
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3812 64D4.tmp 1300 6580.tmp 1108 65FD.tmp 572 66C8.tmp 2040 6755.tmp 3860 6810.tmp 2652 68FB.tmp 4356 69A7.tmp 4456 6AA1.tmp 1248 6B4D.tmp 1440 6BD9.tmp 2172 6C47.tmp 2772 6CB4.tmp 4260 6D6F.tmp 4948 6E0C.tmp 4272 6E79.tmp 1584 6F92.tmp 1240 704E.tmp 1092 70CB.tmp 5112 7167.tmp 4500 71F4.tmp 1784 7290.tmp 3984 734B.tmp 1464 7436.tmp 4840 74E2.tmp 4196 756E.tmp 3756 761A.tmp 3768 7697.tmp 1728 7733.tmp 3708 77EF.tmp 3788 789B.tmp 1180 7937.tmp 4908 79E3.tmp 688 7A7F.tmp 3740 7B2B.tmp 2776 7BA8.tmp 4168 7C73.tmp 4128 7CF0.tmp 2632 7D6D.tmp 1064 7DDB.tmp 440 7E86.tmp 2316 7F13.tmp 1380 7FA0.tmp 3216 801D.tmp 4364 809A.tmp 4044 8126.tmp 4692 81C3.tmp 644 824F.tmp 4112 82EB.tmp 572 8368.tmp 1840 8414.tmp 2040 8491.tmp 3860 852E.tmp 4452 85BA.tmp 4108 8656.tmp 1652 86E3.tmp 3144 877F.tmp 1816 885A.tmp 2232 88D7.tmp 5072 8964.tmp 4800 89E1.tmp 2612 8A7D.tmp 816 8AFA.tmp 4260 8B87.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 3812 1492 2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe 85 PID 1492 wrote to memory of 3812 1492 2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe 85 PID 1492 wrote to memory of 3812 1492 2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe 85 PID 3812 wrote to memory of 1300 3812 64D4.tmp 86 PID 3812 wrote to memory of 1300 3812 64D4.tmp 86 PID 3812 wrote to memory of 1300 3812 64D4.tmp 86 PID 1300 wrote to memory of 1108 1300 6580.tmp 87 PID 1300 wrote to memory of 1108 1300 6580.tmp 87 PID 1300 wrote to memory of 1108 1300 6580.tmp 87 PID 1108 wrote to memory of 572 1108 65FD.tmp 88 PID 1108 wrote to memory of 572 1108 65FD.tmp 88 PID 1108 wrote to memory of 572 1108 65FD.tmp 88 PID 572 wrote to memory of 2040 572 66C8.tmp 89 PID 572 wrote to memory of 2040 572 66C8.tmp 89 PID 572 wrote to memory of 2040 572 66C8.tmp 89 PID 2040 wrote to memory of 3860 2040 6755.tmp 90 PID 2040 wrote to memory of 3860 2040 6755.tmp 90 PID 2040 wrote to memory of 3860 2040 6755.tmp 90 PID 3860 wrote to memory of 2652 3860 6810.tmp 91 PID 3860 wrote to memory of 2652 3860 6810.tmp 91 PID 3860 wrote to memory of 2652 3860 6810.tmp 91 PID 2652 wrote to memory of 4356 2652 68FB.tmp 92 PID 2652 wrote to memory of 4356 2652 68FB.tmp 92 PID 2652 wrote to memory of 4356 2652 68FB.tmp 92 PID 4356 wrote to memory of 4456 4356 69A7.tmp 93 PID 4356 wrote to memory of 4456 4356 69A7.tmp 93 PID 4356 wrote to memory of 4456 4356 69A7.tmp 93 PID 4456 wrote to memory of 1248 4456 6AA1.tmp 94 PID 4456 wrote to memory of 1248 4456 6AA1.tmp 94 PID 4456 wrote to memory of 1248 4456 6AA1.tmp 94 PID 1248 wrote to memory of 1440 1248 6B4D.tmp 95 PID 1248 wrote to memory of 1440 1248 6B4D.tmp 95 PID 1248 wrote to memory of 1440 1248 6B4D.tmp 95 PID 1440 wrote to memory of 2172 1440 6BD9.tmp 96 PID 1440 wrote to memory of 2172 1440 6BD9.tmp 96 PID 1440 wrote to memory of 2172 1440 6BD9.tmp 96 PID 2172 wrote to memory of 2772 2172 6C47.tmp 97 PID 2172 wrote to memory of 2772 2172 6C47.tmp 97 PID 2172 wrote to memory of 2772 2172 6C47.tmp 97 PID 2772 wrote to memory of 4260 2772 6CB4.tmp 99 PID 2772 wrote to memory of 4260 2772 6CB4.tmp 99 PID 2772 wrote to memory of 4260 2772 6CB4.tmp 99 PID 4260 wrote to memory of 4948 4260 6D6F.tmp 100 PID 4260 wrote to memory of 4948 4260 6D6F.tmp 100 PID 4260 wrote to memory of 4948 4260 6D6F.tmp 100 PID 4948 wrote to memory of 4272 4948 6E0C.tmp 101 PID 4948 wrote to memory of 4272 4948 6E0C.tmp 101 PID 4948 wrote to memory of 4272 4948 6E0C.tmp 101 PID 4272 wrote to memory of 1584 4272 6E79.tmp 102 PID 4272 wrote to memory of 1584 4272 6E79.tmp 102 PID 4272 wrote to memory of 1584 4272 6E79.tmp 102 PID 1584 wrote to memory of 1240 1584 6F92.tmp 103 PID 1584 wrote to memory of 1240 1584 6F92.tmp 103 PID 1584 wrote to memory of 1240 1584 6F92.tmp 103 PID 1240 wrote to memory of 1092 1240 704E.tmp 105 PID 1240 wrote to memory of 1092 1240 704E.tmp 105 PID 1240 wrote to memory of 1092 1240 704E.tmp 105 PID 1092 wrote to memory of 5112 1092 70CB.tmp 106 PID 1092 wrote to memory of 5112 1092 70CB.tmp 106 PID 1092 wrote to memory of 5112 1092 70CB.tmp 106 PID 5112 wrote to memory of 4500 5112 7167.tmp 107 PID 5112 wrote to memory of 4500 5112 7167.tmp 107 PID 5112 wrote to memory of 4500 5112 7167.tmp 107 PID 4500 wrote to memory of 1784 4500 71F4.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_d487340e058308d747b231d4fe14a2d3_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"23⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"24⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"25⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"26⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"27⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"28⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\7697.tmp"C:\Users\Admin\AppData\Local\Temp\7697.tmp"29⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"30⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"31⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"32⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"33⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"34⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"35⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"36⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"37⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"38⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"39⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"40⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"41⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"42⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"43⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"44⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"45⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"46⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"47⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"48⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"49⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"50⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"51⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"52⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"53⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"55⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"56⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"57⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"58⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"59⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"60⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"61⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"62⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"63⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"64⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"65⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"66⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"67⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"68⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"69⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"70⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"71⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"72⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"73⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"74⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"75⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"76⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"77⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"78⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"79⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"80⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"81⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"82⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"83⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"84⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"85⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"86⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"87⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"88⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"89⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"90⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"91⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"92⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"93⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"94⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"95⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"96⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"97⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"98⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"99⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"100⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"101⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"102⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"103⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"104⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"105⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"106⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"107⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"108⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"109⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"110⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"111⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"112⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"113⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"114⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"115⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"116⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"117⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"118⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"119⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"120⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"121⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-