Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe
-
Size
487KB
-
MD5
158cf7255871581dba8ac37c4f6b1c1e
-
SHA1
2edabfed3d0f25d2201c10f8960a064aaefbb329
-
SHA256
7bf658d97d1559634712148f52c552c09a4283ad0f72a1d57619451d1119f4b4
-
SHA512
23287549fec737bcc69e18c98edbdd797165f6c518bc6c3e4514a153d9b3df242dd35b06be5705cc1d23d80c8acf5b9cbac4ee2896f1e64dbd76e82ff8521e24
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUzOkobKKngwEWCq8xPGAs6mXNBbTQmU+2jVPZ:HU5rCOTeiJyHcLCrxPGAsnDTyrNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3364 21AC.tmp 2872 2268.tmp 3104 2304.tmp 4728 23EE.tmp 4616 24B9.tmp 4480 2594.tmp 3476 2640.tmp 4640 26EC.tmp 2292 2788.tmp 3304 2834.tmp 5096 28E0.tmp 5012 297C.tmp 2348 2A18.tmp 512 2AF3.tmp 4580 2B9F.tmp 5008 2C7A.tmp 1120 2D35.tmp 3316 2F1A.tmp 2220 2FE5.tmp 3680 30A0.tmp 4936 318B.tmp 5056 3265.tmp 2568 32F2.tmp 4704 33AD.tmp 2456 3459.tmp 2328 3524.tmp 2784 35FF.tmp 4596 369B.tmp 4136 3786.tmp 628 3812.tmp 2180 38CE.tmp 4608 3999.tmp 4036 3A55.tmp 4892 3AD2.tmp 4888 3B4F.tmp 3116 3BDB.tmp 3492 3C58.tmp 3656 3CF4.tmp 688 3D52.tmp 4796 3DDF.tmp 4388 3E6B.tmp 4556 3EE8.tmp 4828 3F56.tmp 4784 40FC.tmp 4300 4188.tmp 4924 4215.tmp 4656 4292.tmp 2308 431F.tmp 3400 43AB.tmp 4380 4438.tmp 1272 44B5.tmp 2368 4541.tmp 3432 45DE.tmp 1636 468A.tmp 5096 4707.tmp 4428 4793.tmp 3612 482F.tmp 1648 48CC.tmp 948 4978.tmp 2484 4A14.tmp 3316 4A91.tmp 1412 4AFE.tmp 416 4B7B.tmp 964 4BE9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4268 wrote to memory of 3364 4268 2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe 82 PID 4268 wrote to memory of 3364 4268 2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe 82 PID 4268 wrote to memory of 3364 4268 2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe 82 PID 3364 wrote to memory of 2872 3364 21AC.tmp 83 PID 3364 wrote to memory of 2872 3364 21AC.tmp 83 PID 3364 wrote to memory of 2872 3364 21AC.tmp 83 PID 2872 wrote to memory of 3104 2872 2268.tmp 84 PID 2872 wrote to memory of 3104 2872 2268.tmp 84 PID 2872 wrote to memory of 3104 2872 2268.tmp 84 PID 3104 wrote to memory of 4728 3104 2304.tmp 85 PID 3104 wrote to memory of 4728 3104 2304.tmp 85 PID 3104 wrote to memory of 4728 3104 2304.tmp 85 PID 4728 wrote to memory of 4616 4728 23EE.tmp 86 PID 4728 wrote to memory of 4616 4728 23EE.tmp 86 PID 4728 wrote to memory of 4616 4728 23EE.tmp 86 PID 4616 wrote to memory of 4480 4616 24B9.tmp 87 PID 4616 wrote to memory of 4480 4616 24B9.tmp 87 PID 4616 wrote to memory of 4480 4616 24B9.tmp 87 PID 4480 wrote to memory of 3476 4480 2594.tmp 88 PID 4480 wrote to memory of 3476 4480 2594.tmp 88 PID 4480 wrote to memory of 3476 4480 2594.tmp 88 PID 3476 wrote to memory of 4640 3476 2640.tmp 89 PID 3476 wrote to memory of 4640 3476 2640.tmp 89 PID 3476 wrote to memory of 4640 3476 2640.tmp 89 PID 4640 wrote to memory of 2292 4640 26EC.tmp 91 PID 4640 wrote to memory of 2292 4640 26EC.tmp 91 PID 4640 wrote to memory of 2292 4640 26EC.tmp 91 PID 2292 wrote to memory of 3304 2292 2788.tmp 92 PID 2292 wrote to memory of 3304 2292 2788.tmp 92 PID 2292 wrote to memory of 3304 2292 2788.tmp 92 PID 3304 wrote to memory of 5096 3304 2834.tmp 94 PID 3304 wrote to memory of 5096 3304 2834.tmp 94 PID 3304 wrote to memory of 5096 3304 2834.tmp 94 PID 5096 wrote to memory of 5012 5096 28E0.tmp 95 PID 5096 wrote to memory of 5012 5096 28E0.tmp 95 PID 5096 wrote to memory of 5012 5096 28E0.tmp 95 PID 5012 wrote to memory of 2348 5012 297C.tmp 96 PID 5012 wrote to memory of 2348 5012 297C.tmp 96 PID 5012 wrote to memory of 2348 5012 297C.tmp 96 PID 2348 wrote to memory of 512 2348 2A18.tmp 97 PID 2348 wrote to memory of 512 2348 2A18.tmp 97 PID 2348 wrote to memory of 512 2348 2A18.tmp 97 PID 512 wrote to memory of 4580 512 2AF3.tmp 98 PID 512 wrote to memory of 4580 512 2AF3.tmp 98 PID 512 wrote to memory of 4580 512 2AF3.tmp 98 PID 4580 wrote to memory of 5008 4580 2B9F.tmp 99 PID 4580 wrote to memory of 5008 4580 2B9F.tmp 99 PID 4580 wrote to memory of 5008 4580 2B9F.tmp 99 PID 5008 wrote to memory of 1120 5008 2C7A.tmp 102 PID 5008 wrote to memory of 1120 5008 2C7A.tmp 102 PID 5008 wrote to memory of 1120 5008 2C7A.tmp 102 PID 1120 wrote to memory of 3316 1120 2D35.tmp 103 PID 1120 wrote to memory of 3316 1120 2D35.tmp 103 PID 1120 wrote to memory of 3316 1120 2D35.tmp 103 PID 3316 wrote to memory of 2220 3316 2F1A.tmp 104 PID 3316 wrote to memory of 2220 3316 2F1A.tmp 104 PID 3316 wrote to memory of 2220 3316 2F1A.tmp 104 PID 2220 wrote to memory of 3680 2220 2FE5.tmp 105 PID 2220 wrote to memory of 3680 2220 2FE5.tmp 105 PID 2220 wrote to memory of 3680 2220 2FE5.tmp 105 PID 3680 wrote to memory of 4936 3680 30A0.tmp 107 PID 3680 wrote to memory of 4936 3680 30A0.tmp 107 PID 3680 wrote to memory of 4936 3680 30A0.tmp 107 PID 4936 wrote to memory of 5056 4936 318B.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_158cf7255871581dba8ac37c4f6b1c1e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2304.tmp"C:\Users\Admin\AppData\Local\Temp\2304.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"23⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"24⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"25⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"26⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"27⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"28⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"29⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"30⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"31⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"32⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3999.tmp"C:\Users\Admin\AppData\Local\Temp\3999.tmp"33⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"34⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"35⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"36⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"37⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"38⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"39⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\3D52.tmp"C:\Users\Admin\AppData\Local\Temp\3D52.tmp"40⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"41⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"42⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"43⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3F56.tmp"C:\Users\Admin\AppData\Local\Temp\3F56.tmp"44⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"45⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"46⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"47⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"48⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"49⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"50⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"51⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"52⤵
- Executes dropped EXE
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"53⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"54⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"55⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"56⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"57⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"58⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"59⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"60⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"61⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4A91.tmp"C:\Users\Admin\AppData\Local\Temp\4A91.tmp"62⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"63⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"64⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"65⤵
- Executes dropped EXE
PID:964 -
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"66⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"67⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"68⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"69⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"70⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"71⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"72⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"73⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"74⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"75⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"76⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"77⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"78⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"79⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"80⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"81⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"82⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"83⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"84⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"85⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"86⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"87⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5733.tmp"C:\Users\Admin\AppData\Local\Temp\5733.tmp"88⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"89⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\582D.tmp"C:\Users\Admin\AppData\Local\Temp\582D.tmp"90⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"91⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"92⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"93⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"94⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"95⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"96⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"97⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"98⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"99⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"100⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"101⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\5F51.tmp"C:\Users\Admin\AppData\Local\Temp\5F51.tmp"102⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"103⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\60A9.tmp"C:\Users\Admin\AppData\Local\Temp\60A9.tmp"104⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\6145.tmp"C:\Users\Admin\AppData\Local\Temp\6145.tmp"105⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"106⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"107⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"108⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"109⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"110⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"111⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"112⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"113⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"114⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"115⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"116⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"117⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\6944.tmp"C:\Users\Admin\AppData\Local\Temp\6944.tmp"118⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"119⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"120⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"121⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"122⤵PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-