Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe
-
Size
520KB
-
MD5
2e01431c6b3be61d3be8296d3af97567
-
SHA1
f8027eb1f319cd2f6ffe8a09d4c8dd4bac9f19ae
-
SHA256
033b01741ff9c1658453480e2583a4c31f520609b869d60034bf9919f1430014
-
SHA512
642fbffa064986b38403098334581914947f292223e52253726331a49697c11c7bc8351c44d092a02d1041c8fd1e990c15ca185ec3b2b758b6eb58316b932e42
-
SSDEEP
12288:gj8fuxR21t5i8fMxBi2sd1z9JE0Mk+fv3pphgbmVlCNZ:gj8fuK1GYSBi2sd1pJ/M7v5APN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2380 8397.tmp 3456 8434.tmp 412 84C0.tmp 1888 856C.tmp 4452 8628.tmp 4492 8702.tmp 1140 879F.tmp 492 883B.tmp 3160 8944.tmp 820 89D1.tmp 2504 8A4E.tmp 2936 8AEA.tmp 1272 8BA6.tmp 4156 8C81.tmp 4564 8D3C.tmp 4812 8E84.tmp 5032 8F20.tmp 2964 8FDC.tmp 4964 9088.tmp 4524 9134.tmp 4320 91D0.tmp 1260 928B.tmp 2356 9328.tmp 2772 93D4.tmp 4504 9460.tmp 1784 94FC.tmp 3996 9579.tmp 4172 96B2.tmp 2168 974E.tmp 1912 97EA.tmp 2524 98B6.tmp 2752 9971.tmp 4432 9A0D.tmp 4012 9A8A.tmp 1884 9B27.tmp 4456 9BB3.tmp 3972 9C30.tmp 1964 9CBD.tmp 4116 9D3A.tmp 4776 9DB7.tmp 1120 9E43.tmp 4220 9EC0.tmp 4880 9F4D.tmp 3200 9FCA.tmp 1736 A037.tmp 2504 A0C4.tmp 3220 A131.tmp 1288 A1DD.tmp 3416 A27A.tmp 3608 A2F7.tmp 756 A364.tmp 4156 A3C2.tmp 4620 A45E.tmp 4924 A4EB.tmp 4472 A577.tmp 4916 A604.tmp 5032 A690.tmp 4416 A70D.tmp 3036 A7AA.tmp 4512 A836.tmp 4212 A8B3.tmp 3528 A930.tmp 3892 A9CD.tmp 4188 AA88.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 456 wrote to memory of 2380 456 2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe 85 PID 456 wrote to memory of 2380 456 2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe 85 PID 456 wrote to memory of 2380 456 2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe 85 PID 2380 wrote to memory of 3456 2380 8397.tmp 87 PID 2380 wrote to memory of 3456 2380 8397.tmp 87 PID 2380 wrote to memory of 3456 2380 8397.tmp 87 PID 3456 wrote to memory of 412 3456 8434.tmp 88 PID 3456 wrote to memory of 412 3456 8434.tmp 88 PID 3456 wrote to memory of 412 3456 8434.tmp 88 PID 412 wrote to memory of 1888 412 84C0.tmp 89 PID 412 wrote to memory of 1888 412 84C0.tmp 89 PID 412 wrote to memory of 1888 412 84C0.tmp 89 PID 1888 wrote to memory of 4452 1888 856C.tmp 90 PID 1888 wrote to memory of 4452 1888 856C.tmp 90 PID 1888 wrote to memory of 4452 1888 856C.tmp 90 PID 4452 wrote to memory of 4492 4452 8628.tmp 91 PID 4452 wrote to memory of 4492 4452 8628.tmp 91 PID 4452 wrote to memory of 4492 4452 8628.tmp 91 PID 4492 wrote to memory of 1140 4492 8702.tmp 92 PID 4492 wrote to memory of 1140 4492 8702.tmp 92 PID 4492 wrote to memory of 1140 4492 8702.tmp 92 PID 1140 wrote to memory of 492 1140 879F.tmp 93 PID 1140 wrote to memory of 492 1140 879F.tmp 93 PID 1140 wrote to memory of 492 1140 879F.tmp 93 PID 492 wrote to memory of 3160 492 883B.tmp 94 PID 492 wrote to memory of 3160 492 883B.tmp 94 PID 492 wrote to memory of 3160 492 883B.tmp 94 PID 3160 wrote to memory of 820 3160 8944.tmp 95 PID 3160 wrote to memory of 820 3160 8944.tmp 95 PID 3160 wrote to memory of 820 3160 8944.tmp 95 PID 820 wrote to memory of 2504 820 89D1.tmp 96 PID 820 wrote to memory of 2504 820 89D1.tmp 96 PID 820 wrote to memory of 2504 820 89D1.tmp 96 PID 2504 wrote to memory of 2936 2504 8A4E.tmp 97 PID 2504 wrote to memory of 2936 2504 8A4E.tmp 97 PID 2504 wrote to memory of 2936 2504 8A4E.tmp 97 PID 2936 wrote to memory of 1272 2936 8AEA.tmp 98 PID 2936 wrote to memory of 1272 2936 8AEA.tmp 98 PID 2936 wrote to memory of 1272 2936 8AEA.tmp 98 PID 1272 wrote to memory of 4156 1272 8BA6.tmp 99 PID 1272 wrote to memory of 4156 1272 8BA6.tmp 99 PID 1272 wrote to memory of 4156 1272 8BA6.tmp 99 PID 4156 wrote to memory of 4564 4156 8C81.tmp 101 PID 4156 wrote to memory of 4564 4156 8C81.tmp 101 PID 4156 wrote to memory of 4564 4156 8C81.tmp 101 PID 4564 wrote to memory of 4812 4564 8D3C.tmp 104 PID 4564 wrote to memory of 4812 4564 8D3C.tmp 104 PID 4564 wrote to memory of 4812 4564 8D3C.tmp 104 PID 4812 wrote to memory of 5032 4812 8E84.tmp 105 PID 4812 wrote to memory of 5032 4812 8E84.tmp 105 PID 4812 wrote to memory of 5032 4812 8E84.tmp 105 PID 5032 wrote to memory of 2964 5032 8F20.tmp 106 PID 5032 wrote to memory of 2964 5032 8F20.tmp 106 PID 5032 wrote to memory of 2964 5032 8F20.tmp 106 PID 2964 wrote to memory of 4964 2964 8FDC.tmp 108 PID 2964 wrote to memory of 4964 2964 8FDC.tmp 108 PID 2964 wrote to memory of 4964 2964 8FDC.tmp 108 PID 4964 wrote to memory of 4524 4964 9088.tmp 109 PID 4964 wrote to memory of 4524 4964 9088.tmp 109 PID 4964 wrote to memory of 4524 4964 9088.tmp 109 PID 4524 wrote to memory of 4320 4524 9134.tmp 110 PID 4524 wrote to memory of 4320 4524 9134.tmp 110 PID 4524 wrote to memory of 4320 4524 9134.tmp 110 PID 4320 wrote to memory of 1260 4320 91D0.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_2e01431c6b3be61d3be8296d3af97567_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\856C.tmp"C:\Users\Admin\AppData\Local\Temp\856C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"23⤵
- Executes dropped EXE
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"24⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"25⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"26⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"27⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"28⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"29⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"30⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"31⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"32⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"33⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"34⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"35⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"36⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"37⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"38⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"39⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"40⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"41⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"42⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"43⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"44⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"45⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"46⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"47⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"48⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"49⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"50⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"51⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"52⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"53⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"54⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"55⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"56⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"57⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"58⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"59⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"60⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"61⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"62⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"63⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"64⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"65⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"66⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"67⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"68⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"69⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"70⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"71⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"72⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"73⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"74⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"75⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"76⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"77⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"78⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"79⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"80⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"81⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"82⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"83⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"84⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"85⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"86⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"87⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"88⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"90⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"91⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"92⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"93⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"94⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"95⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"96⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"97⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"98⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"99⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"100⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"101⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"102⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"103⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"104⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"105⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"106⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"107⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"108⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"109⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"110⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"111⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"112⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"113⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"114⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"115⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"116⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"117⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"118⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"119⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"120⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"121⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"122⤵PID:2412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-