Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe
-
Size
486KB
-
MD5
5577aaf9ec86750be38c1fc05bf657c2
-
SHA1
0521b95f8b741124812e1371fcc85b42328f8d80
-
SHA256
a653a9d78b2ff57830fdb0ac46358ee0a3063e3c37b9b4b9ac2b16354e348c26
-
SHA512
1cc68fc08f817cbd380a619c92c5d97d29c902f10176e94fd470f15dc1ec520de4df17e1599d97735256b264878851297c9e4cfd142a2bb6ed3b3e576bbe6817
-
SSDEEP
12288:/U5rCOTeiD+UW7uzLjP68+kXC7OghMdJmNZ:/UQOJD+UOgLHy7NS2N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2316 65EE.tmp 3508 667A.tmp 3668 66F7.tmp 224 67B3.tmp 4144 683F.tmp 4336 68CC.tmp 3936 6978.tmp 3984 6A62.tmp 2800 6B0E.tmp 2000 6BD9.tmp 4708 6C75.tmp 3476 6D12.tmp 2828 6D8F.tmp 2340 6E1B.tmp 944 6EA8.tmp 4728 6F54.tmp 2844 6FE0.tmp 1276 70DA.tmp 4468 7196.tmp 2440 7213.tmp 1616 72CE.tmp 2024 737A.tmp 2804 7426.tmp 4516 74C2.tmp 4088 75EB.tmp 1944 7688.tmp 1240 7733.tmp 1540 780E.tmp 3216 78CA.tmp 2100 7995.tmp 4724 7A21.tmp 3396 7AFC.tmp 3440 7BE7.tmp 4364 7C83.tmp 3972 7D0F.tmp 1156 7D9C.tmp 3500 7E29.tmp 3080 7EA6.tmp 4876 7F23.tmp 3292 7FBF.tmp 2300 806B.tmp 1376 80E8.tmp 2224 8165.tmp 464 81F1.tmp 2304 827E.tmp 388 831A.tmp 4024 83A7.tmp 3084 8453.tmp 4000 84D0.tmp 3508 854D.tmp 1748 85E9.tmp 1108 8676.tmp 4060 86E3.tmp 1728 877F.tmp 3676 880C.tmp 992 8899.tmp 560 8916.tmp 2996 8993.tmp 5096 8A2F.tmp 1264 8AAC.tmp 2800 8B67.tmp 2792 8BF4.tmp 4776 8C71.tmp 3164 8CEE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 2316 4024 2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe 86 PID 4024 wrote to memory of 2316 4024 2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe 86 PID 4024 wrote to memory of 2316 4024 2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe 86 PID 2316 wrote to memory of 3508 2316 65EE.tmp 87 PID 2316 wrote to memory of 3508 2316 65EE.tmp 87 PID 2316 wrote to memory of 3508 2316 65EE.tmp 87 PID 3508 wrote to memory of 3668 3508 667A.tmp 89 PID 3508 wrote to memory of 3668 3508 667A.tmp 89 PID 3508 wrote to memory of 3668 3508 667A.tmp 89 PID 3668 wrote to memory of 224 3668 66F7.tmp 90 PID 3668 wrote to memory of 224 3668 66F7.tmp 90 PID 3668 wrote to memory of 224 3668 66F7.tmp 90 PID 224 wrote to memory of 4144 224 67B3.tmp 91 PID 224 wrote to memory of 4144 224 67B3.tmp 91 PID 224 wrote to memory of 4144 224 67B3.tmp 91 PID 4144 wrote to memory of 4336 4144 683F.tmp 92 PID 4144 wrote to memory of 4336 4144 683F.tmp 92 PID 4144 wrote to memory of 4336 4144 683F.tmp 92 PID 4336 wrote to memory of 3936 4336 68CC.tmp 93 PID 4336 wrote to memory of 3936 4336 68CC.tmp 93 PID 4336 wrote to memory of 3936 4336 68CC.tmp 93 PID 3936 wrote to memory of 3984 3936 6978.tmp 94 PID 3936 wrote to memory of 3984 3936 6978.tmp 94 PID 3936 wrote to memory of 3984 3936 6978.tmp 94 PID 3984 wrote to memory of 2800 3984 6A62.tmp 95 PID 3984 wrote to memory of 2800 3984 6A62.tmp 95 PID 3984 wrote to memory of 2800 3984 6A62.tmp 95 PID 2800 wrote to memory of 2000 2800 6B0E.tmp 96 PID 2800 wrote to memory of 2000 2800 6B0E.tmp 96 PID 2800 wrote to memory of 2000 2800 6B0E.tmp 96 PID 2000 wrote to memory of 4708 2000 6BD9.tmp 97 PID 2000 wrote to memory of 4708 2000 6BD9.tmp 97 PID 2000 wrote to memory of 4708 2000 6BD9.tmp 97 PID 4708 wrote to memory of 3476 4708 6C75.tmp 98 PID 4708 wrote to memory of 3476 4708 6C75.tmp 98 PID 4708 wrote to memory of 3476 4708 6C75.tmp 98 PID 3476 wrote to memory of 2828 3476 6D12.tmp 99 PID 3476 wrote to memory of 2828 3476 6D12.tmp 99 PID 3476 wrote to memory of 2828 3476 6D12.tmp 99 PID 2828 wrote to memory of 2340 2828 6D8F.tmp 100 PID 2828 wrote to memory of 2340 2828 6D8F.tmp 100 PID 2828 wrote to memory of 2340 2828 6D8F.tmp 100 PID 2340 wrote to memory of 944 2340 6E1B.tmp 101 PID 2340 wrote to memory of 944 2340 6E1B.tmp 101 PID 2340 wrote to memory of 944 2340 6E1B.tmp 101 PID 944 wrote to memory of 4728 944 6EA8.tmp 103 PID 944 wrote to memory of 4728 944 6EA8.tmp 103 PID 944 wrote to memory of 4728 944 6EA8.tmp 103 PID 4728 wrote to memory of 2844 4728 6F54.tmp 104 PID 4728 wrote to memory of 2844 4728 6F54.tmp 104 PID 4728 wrote to memory of 2844 4728 6F54.tmp 104 PID 2844 wrote to memory of 1276 2844 6FE0.tmp 105 PID 2844 wrote to memory of 1276 2844 6FE0.tmp 105 PID 2844 wrote to memory of 1276 2844 6FE0.tmp 105 PID 1276 wrote to memory of 4468 1276 70DA.tmp 107 PID 1276 wrote to memory of 4468 1276 70DA.tmp 107 PID 1276 wrote to memory of 4468 1276 70DA.tmp 107 PID 4468 wrote to memory of 2440 4468 7196.tmp 108 PID 4468 wrote to memory of 2440 4468 7196.tmp 108 PID 4468 wrote to memory of 2440 4468 7196.tmp 108 PID 2440 wrote to memory of 1616 2440 7213.tmp 109 PID 2440 wrote to memory of 1616 2440 7213.tmp 109 PID 2440 wrote to memory of 1616 2440 7213.tmp 109 PID 1616 wrote to memory of 2024 1616 72CE.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-23_5577aaf9ec86750be38c1fc05bf657c2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"23⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"24⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\74C2.tmp"C:\Users\Admin\AppData\Local\Temp\74C2.tmp"25⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"26⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"27⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"28⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"29⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"30⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"31⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"32⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"33⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"34⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"35⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"C:\Users\Admin\AppData\Local\Temp\7D0F.tmp"36⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"37⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"38⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"39⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"40⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"41⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"42⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"43⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"44⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"45⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"46⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"47⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"48⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"49⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"50⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"51⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"52⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"53⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"54⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"55⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"56⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"57⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"58⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"59⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"60⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"61⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"62⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"63⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"64⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"65⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"66⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"67⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"68⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"69⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"70⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"71⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"72⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"73⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"74⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"75⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"76⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"77⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"78⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"79⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"81⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"82⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"83⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"84⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"85⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"86⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"87⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"88⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"89⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"90⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"91⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\9B55.tmp"C:\Users\Admin\AppData\Local\Temp\9B55.tmp"92⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"93⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"94⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"95⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"96⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"97⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"98⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"99⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"100⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"101⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"102⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"103⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"104⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"105⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"106⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"107⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"108⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"109⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"110⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"111⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"112⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"113⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"114⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"115⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"116⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"117⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"118⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"119⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"120⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"121⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"122⤵PID:3588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-