Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2023, 17:02
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe
-
Size
488KB
-
MD5
e1c1534057c0e96a9f4e618e970e1890
-
SHA1
c1b6f18c95004822fd13b1f03d320d76ed252dc6
-
SHA256
3ccfb5c9bd311850ba5bbbbd56446bccc7617aa5764966029070bd52bfa1e20f
-
SHA512
ed2b11c491bd353624eb317912652da7d53a41dbcf8daaa09c2ca05795eec72280575fecc1e6b2091626e0d8369ddb15a771bc360d1bdc8f373cb2f7490c1c8a
-
SSDEEP
12288:/U5rCOTeiD0UKtvjEoLqwGg8Vpux9ONZ:/UQOJD0JtvjLLqJJpGON
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4408 781E.tmp 4996 78D9.tmp 224 7966.tmp 2320 7A50.tmp 3240 7BD7.tmp 4264 7C73.tmp 1488 7D1F.tmp 2152 87DD.tmp 2052 886A.tmp 2252 88F6.tmp 4536 8993.tmp 4312 8A3E.tmp 2128 8AEA.tmp 2856 8BA6.tmp 1876 8C23.tmp 4252 8CA0.tmp 4356 8D2C.tmp 4724 8DB9.tmp 3572 8E36.tmp 1772 8F5F.tmp 4884 900B.tmp 4740 9097.tmp 3896 9124.tmp 2916 91E0.tmp 4764 928B.tmp 4228 9366.tmp 4224 93E3.tmp 652 948F.tmp 3988 9616.tmp 3348 96A2.tmp 2248 971F.tmp 4928 97CB.tmp 4716 9867.tmp 4332 98C5.tmp 2132 9942.tmp 2320 9A5B.tmp 1264 9AF8.tmp 2812 9B94.tmp 4968 9C21.tmp 2056 9CBD.tmp 1888 9D3A.tmp 4672 9DC6.tmp 4796 9E43.tmp 3012 9ED0.tmp 528 9F6C.tmp 840 A009.tmp 4208 A076.tmp 1624 A122.tmp 4576 A1AE.tmp 3208 A24B.tmp 2856 A2E7.tmp 2372 A393.tmp 900 A41F.tmp 4484 A49C.tmp 5040 A568.tmp 2264 A5E5.tmp 808 A662.tmp 2528 A6EE.tmp 772 A7AA.tmp 2200 A846.tmp 4248 A8E2.tmp 3916 A96F.tmp 2324 A9DC.tmp 1960 AA69.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4408 3540 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 85 PID 3540 wrote to memory of 4408 3540 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 85 PID 3540 wrote to memory of 4408 3540 2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe 85 PID 4408 wrote to memory of 4996 4408 781E.tmp 86 PID 4408 wrote to memory of 4996 4408 781E.tmp 86 PID 4408 wrote to memory of 4996 4408 781E.tmp 86 PID 4996 wrote to memory of 224 4996 78D9.tmp 88 PID 4996 wrote to memory of 224 4996 78D9.tmp 88 PID 4996 wrote to memory of 224 4996 78D9.tmp 88 PID 224 wrote to memory of 2320 224 7966.tmp 89 PID 224 wrote to memory of 2320 224 7966.tmp 89 PID 224 wrote to memory of 2320 224 7966.tmp 89 PID 2320 wrote to memory of 3240 2320 7A50.tmp 90 PID 2320 wrote to memory of 3240 2320 7A50.tmp 90 PID 2320 wrote to memory of 3240 2320 7A50.tmp 90 PID 3240 wrote to memory of 4264 3240 7BD7.tmp 91 PID 3240 wrote to memory of 4264 3240 7BD7.tmp 91 PID 3240 wrote to memory of 4264 3240 7BD7.tmp 91 PID 4264 wrote to memory of 1488 4264 7C73.tmp 92 PID 4264 wrote to memory of 1488 4264 7C73.tmp 92 PID 4264 wrote to memory of 1488 4264 7C73.tmp 92 PID 1488 wrote to memory of 2152 1488 7D1F.tmp 93 PID 1488 wrote to memory of 2152 1488 7D1F.tmp 93 PID 1488 wrote to memory of 2152 1488 7D1F.tmp 93 PID 2152 wrote to memory of 2052 2152 87DD.tmp 94 PID 2152 wrote to memory of 2052 2152 87DD.tmp 94 PID 2152 wrote to memory of 2052 2152 87DD.tmp 94 PID 2052 wrote to memory of 2252 2052 886A.tmp 95 PID 2052 wrote to memory of 2252 2052 886A.tmp 95 PID 2052 wrote to memory of 2252 2052 886A.tmp 95 PID 2252 wrote to memory of 4536 2252 88F6.tmp 96 PID 2252 wrote to memory of 4536 2252 88F6.tmp 96 PID 2252 wrote to memory of 4536 2252 88F6.tmp 96 PID 4536 wrote to memory of 4312 4536 8993.tmp 97 PID 4536 wrote to memory of 4312 4536 8993.tmp 97 PID 4536 wrote to memory of 4312 4536 8993.tmp 97 PID 4312 wrote to memory of 2128 4312 8A3E.tmp 98 PID 4312 wrote to memory of 2128 4312 8A3E.tmp 98 PID 4312 wrote to memory of 2128 4312 8A3E.tmp 98 PID 2128 wrote to memory of 2856 2128 8AEA.tmp 99 PID 2128 wrote to memory of 2856 2128 8AEA.tmp 99 PID 2128 wrote to memory of 2856 2128 8AEA.tmp 99 PID 2856 wrote to memory of 1876 2856 8BA6.tmp 101 PID 2856 wrote to memory of 1876 2856 8BA6.tmp 101 PID 2856 wrote to memory of 1876 2856 8BA6.tmp 101 PID 1876 wrote to memory of 4252 1876 8C23.tmp 102 PID 1876 wrote to memory of 4252 1876 8C23.tmp 102 PID 1876 wrote to memory of 4252 1876 8C23.tmp 102 PID 4252 wrote to memory of 4356 4252 8CA0.tmp 103 PID 4252 wrote to memory of 4356 4252 8CA0.tmp 103 PID 4252 wrote to memory of 4356 4252 8CA0.tmp 103 PID 4356 wrote to memory of 4724 4356 8D2C.tmp 106 PID 4356 wrote to memory of 4724 4356 8D2C.tmp 106 PID 4356 wrote to memory of 4724 4356 8D2C.tmp 106 PID 4724 wrote to memory of 3572 4724 8DB9.tmp 107 PID 4724 wrote to memory of 3572 4724 8DB9.tmp 107 PID 4724 wrote to memory of 3572 4724 8DB9.tmp 107 PID 3572 wrote to memory of 1772 3572 8E36.tmp 109 PID 3572 wrote to memory of 1772 3572 8E36.tmp 109 PID 3572 wrote to memory of 1772 3572 8E36.tmp 109 PID 1772 wrote to memory of 4884 1772 8F5F.tmp 110 PID 1772 wrote to memory of 4884 1772 8F5F.tmp 110 PID 1772 wrote to memory of 4884 1772 8F5F.tmp 110 PID 4884 wrote to memory of 4740 4884 900B.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-26_e1c1534057c0e96a9f4e618e970e1890_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"23⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"24⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"25⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"26⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"27⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"28⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"29⤵
- Executes dropped EXE
PID:652 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"30⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"31⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"32⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"33⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"34⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"35⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"36⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"37⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"38⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"39⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"40⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"41⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"42⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"43⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"44⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"45⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"46⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"47⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"48⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"49⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"50⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"51⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"52⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"53⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"54⤵
- Executes dropped EXE
PID:900 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"55⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"56⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"57⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"58⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"59⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"60⤵
- Executes dropped EXE
PID:772 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"61⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"62⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"63⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"64⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"65⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"66⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"67⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"68⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"69⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"70⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"71⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"72⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"73⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"74⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"75⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"76⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"77⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"78⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"79⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"80⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"81⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"82⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"83⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"84⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"85⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"86⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"88⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"89⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"90⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"91⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"92⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"93⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"94⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"95⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"96⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"97⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"98⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"99⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"100⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"101⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"102⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"103⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"104⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"105⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"106⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"107⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"108⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"109⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"110⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\C469.tmp"C:\Users\Admin\AppData\Local\Temp\C469.tmp"111⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"113⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"114⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"115⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"116⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"117⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"118⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"119⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"120⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"121⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"122⤵PID:4240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-