Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe
-
Size
486KB
-
MD5
1174777438cfd21f22f283359a57f250
-
SHA1
2e779720b43c61a9d8d496b5482a7be131b354fe
-
SHA256
1041f1df20c03faf4459aad8532038b4aacd6edd22d4666932e853c5e2c44000
-
SHA512
351ce3ab32a4ba52335e10fabfb24569ad4b669a9814162ae38b69bb8e9ca57b51c665af4b5941ec93f5902d4df167e49db3c42d08d5a9e7715245f5ba9110e8
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7AR4crDh6HVLgPyb5zhaUhI9H1FXgrZsH3dZ:UU5rCOTeiDAk1MQ2UhI9HXgCNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3544 654.tmp 456 7BB.tmp 2596 8C5.tmp 628 971.tmp 2312 A3C.tmp 1440 B07.tmp 4384 BD2.tmp 3564 C6F.tmp 4544 D3A.tmp 5076 EB1.tmp 3284 F8B.tmp 4716 1076.tmp 2964 1354.tmp 224 142F.tmp 3056 14CB.tmp 1180 1567.tmp 4556 1690.tmp 2800 172D.tmp 1676 1807.tmp 1720 18E2.tmp 3924 19AD.tmp 3304 1AB7.tmp 852 1B92.tmp 5056 1C7C.tmp 1216 1D28.tmp 956 1E03.tmp 3144 1EED.tmp 2316 2025.tmp 1812 20F1.tmp 4164 21EB.tmp 4360 2296.tmp 2500 23A0.tmp 4352 249A.tmp 4300 2507.tmp 2572 25A4.tmp 1448 269E.tmp 1296 2834.tmp 4120 28E0.tmp 3608 298C.tmp 2204 2A28.tmp 2308 2AC4.tmp 4656 2B60.tmp 1808 2BFD.tmp 1452 2C7A.tmp 3896 2CF7.tmp 4544 2D83.tmp 4696 2E10.tmp 3788 2EBC.tmp 1740 2F87.tmp 1924 3014.tmp 4076 3091.tmp 3928 312D.tmp 3876 31B9.tmp 1328 3227.tmp 1408 32A4.tmp 3484 33BD.tmp 5044 344A.tmp 1496 34C7.tmp 1572 3553.tmp 1592 35FF.tmp 1720 368C.tmp 908 3728.tmp 3776 37B5.tmp 4232 3841.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 3544 4432 2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe 88 PID 4432 wrote to memory of 3544 4432 2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe 88 PID 4432 wrote to memory of 3544 4432 2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe 88 PID 3544 wrote to memory of 456 3544 654.tmp 89 PID 3544 wrote to memory of 456 3544 654.tmp 89 PID 3544 wrote to memory of 456 3544 654.tmp 89 PID 456 wrote to memory of 2596 456 7BB.tmp 90 PID 456 wrote to memory of 2596 456 7BB.tmp 90 PID 456 wrote to memory of 2596 456 7BB.tmp 90 PID 2596 wrote to memory of 628 2596 8C5.tmp 92 PID 2596 wrote to memory of 628 2596 8C5.tmp 92 PID 2596 wrote to memory of 628 2596 8C5.tmp 92 PID 628 wrote to memory of 2312 628 971.tmp 93 PID 628 wrote to memory of 2312 628 971.tmp 93 PID 628 wrote to memory of 2312 628 971.tmp 93 PID 2312 wrote to memory of 1440 2312 A3C.tmp 94 PID 2312 wrote to memory of 1440 2312 A3C.tmp 94 PID 2312 wrote to memory of 1440 2312 A3C.tmp 94 PID 1440 wrote to memory of 4384 1440 B07.tmp 95 PID 1440 wrote to memory of 4384 1440 B07.tmp 95 PID 1440 wrote to memory of 4384 1440 B07.tmp 95 PID 4384 wrote to memory of 3564 4384 BD2.tmp 96 PID 4384 wrote to memory of 3564 4384 BD2.tmp 96 PID 4384 wrote to memory of 3564 4384 BD2.tmp 96 PID 3564 wrote to memory of 4544 3564 C6F.tmp 97 PID 3564 wrote to memory of 4544 3564 C6F.tmp 97 PID 3564 wrote to memory of 4544 3564 C6F.tmp 97 PID 4544 wrote to memory of 5076 4544 D3A.tmp 99 PID 4544 wrote to memory of 5076 4544 D3A.tmp 99 PID 4544 wrote to memory of 5076 4544 D3A.tmp 99 PID 5076 wrote to memory of 3284 5076 EB1.tmp 100 PID 5076 wrote to memory of 3284 5076 EB1.tmp 100 PID 5076 wrote to memory of 3284 5076 EB1.tmp 100 PID 3284 wrote to memory of 4716 3284 F8B.tmp 101 PID 3284 wrote to memory of 4716 3284 F8B.tmp 101 PID 3284 wrote to memory of 4716 3284 F8B.tmp 101 PID 4716 wrote to memory of 2964 4716 1076.tmp 102 PID 4716 wrote to memory of 2964 4716 1076.tmp 102 PID 4716 wrote to memory of 2964 4716 1076.tmp 102 PID 2964 wrote to memory of 224 2964 1354.tmp 103 PID 2964 wrote to memory of 224 2964 1354.tmp 103 PID 2964 wrote to memory of 224 2964 1354.tmp 103 PID 224 wrote to memory of 3056 224 142F.tmp 104 PID 224 wrote to memory of 3056 224 142F.tmp 104 PID 224 wrote to memory of 3056 224 142F.tmp 104 PID 3056 wrote to memory of 1180 3056 14CB.tmp 105 PID 3056 wrote to memory of 1180 3056 14CB.tmp 105 PID 3056 wrote to memory of 1180 3056 14CB.tmp 105 PID 1180 wrote to memory of 4556 1180 1567.tmp 106 PID 1180 wrote to memory of 4556 1180 1567.tmp 106 PID 1180 wrote to memory of 4556 1180 1567.tmp 106 PID 4556 wrote to memory of 2800 4556 1690.tmp 107 PID 4556 wrote to memory of 2800 4556 1690.tmp 107 PID 4556 wrote to memory of 2800 4556 1690.tmp 107 PID 2800 wrote to memory of 1676 2800 172D.tmp 108 PID 2800 wrote to memory of 1676 2800 172D.tmp 108 PID 2800 wrote to memory of 1676 2800 172D.tmp 108 PID 1676 wrote to memory of 1720 1676 1807.tmp 109 PID 1676 wrote to memory of 1720 1676 1807.tmp 109 PID 1676 wrote to memory of 1720 1676 1807.tmp 109 PID 1720 wrote to memory of 3924 1720 18E2.tmp 110 PID 1720 wrote to memory of 3924 1720 18E2.tmp 110 PID 1720 wrote to memory of 3924 1720 18E2.tmp 110 PID 3924 wrote to memory of 3304 3924 19AD.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_1174777438cfd21f22f283359a57f250_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\971.tmp"C:\Users\Admin\AppData\Local\Temp\971.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\B07.tmp"C:\Users\Admin\AppData\Local\Temp\B07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\1807.tmp"C:\Users\Admin\AppData\Local\Temp\1807.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"23⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"24⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"25⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"26⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"27⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"28⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"29⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"30⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"31⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"32⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"33⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"34⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"35⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"36⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"37⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"38⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"39⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"40⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"41⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"42⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"43⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"44⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"45⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"46⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"47⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2E10.tmp"C:\Users\Admin\AppData\Local\Temp\2E10.tmp"48⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"49⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"50⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"51⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"52⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"53⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"54⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\3227.tmp"C:\Users\Admin\AppData\Local\Temp\3227.tmp"55⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"56⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"57⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"58⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"59⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"60⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"61⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"62⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"63⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"64⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"65⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"66⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\394B.tmp"C:\Users\Admin\AppData\Local\Temp\394B.tmp"67⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"68⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"69⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"70⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"71⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"72⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"73⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"74⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"75⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"76⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"77⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"78⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"79⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"80⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"81⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"82⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"83⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"84⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"85⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"86⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"87⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"88⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"89⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"90⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"91⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\48BC.tmp"C:\Users\Admin\AppData\Local\Temp\48BC.tmp"92⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"93⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"94⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"95⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"96⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"97⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"98⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\4D31.tmp"C:\Users\Admin\AppData\Local\Temp\4D31.tmp"99⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"100⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"101⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"102⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"103⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"104⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"106⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"107⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"108⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"109⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"110⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"111⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"112⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5520.tmp"C:\Users\Admin\AppData\Local\Temp\5520.tmp"113⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"114⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"115⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"116⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"117⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"118⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"119⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"120⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"121⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"122⤵PID:1784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-