Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe
-
Size
520KB
-
MD5
499ad3c570b8998c9eea443e73bf2ffb
-
SHA1
d703d1e0f0b4702a156b4dc12486ef83f7f67eb2
-
SHA256
bdc0bbe7d2117ab80493c29cb03ece9fce777d4ec5581e09a0dce4339e38927c
-
SHA512
715b85e217c16576401ca35a1744a79b64f37933c2bc288d8e86d4b606409633493387a5d7055bcba5145745eb840457b1f365e7c1689a256525e244aab2c870
-
SSDEEP
12288:gj8fuxR21t5i8fpV4NXfWc73/LR3w+mbHwwdQsMNZ:gj8fuK1GY74NDFgRbHzKN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4556 5E8B.tmp 4760 5F37.tmp 3572 5FC3.tmp 3932 608F.tmp 2680 613A.tmp 876 61C7.tmp 2012 6254.tmp 2008 634E.tmp 1476 63FA.tmp 1020 64C5.tmp 2676 6571.tmp 4960 65EE.tmp 4360 66B9.tmp 1528 6745.tmp 5028 68CC.tmp 2492 6959.tmp 2332 69C6.tmp 2664 6A53.tmp 4680 6AFE.tmp 2780 6B8B.tmp 3372 6C08.tmp 996 6D12.tmp 1144 6DAE.tmp 4696 6E3B.tmp 4904 6EB8.tmp 1224 6F35.tmp 5112 6FD1.tmp 4020 703E.tmp 2824 7129.tmp 4700 7213.tmp 2156 72CE.tmp 532 736B.tmp 3008 7417.tmp 4076 74A3.tmp 4308 753F.tmp 3424 75DC.tmp 376 7649.tmp 2720 76B6.tmp 380 78BA.tmp 4588 7937.tmp 2768 79A4.tmp 2388 7A21.tmp 1852 7A9E.tmp 4844 7B4A.tmp 728 7BE7.tmp 1956 7C92.tmp 4880 7D2F.tmp 428 7DDB.tmp 3748 7E86.tmp 1264 7F23.tmp 4492 7FBF.tmp 848 804C.tmp 856 80B9.tmp 2904 8126.tmp 1248 81C3.tmp 4952 824F.tmp 1944 83B7.tmp 2172 8462.tmp 4620 84D0.tmp 1132 854D.tmp 1620 85D9.tmp 2840 8647.tmp 3036 86B4.tmp 1080 8731.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4556 3148 2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe 85 PID 3148 wrote to memory of 4556 3148 2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe 85 PID 3148 wrote to memory of 4556 3148 2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe 85 PID 4556 wrote to memory of 4760 4556 5E8B.tmp 86 PID 4556 wrote to memory of 4760 4556 5E8B.tmp 86 PID 4556 wrote to memory of 4760 4556 5E8B.tmp 86 PID 4760 wrote to memory of 3572 4760 5F37.tmp 87 PID 4760 wrote to memory of 3572 4760 5F37.tmp 87 PID 4760 wrote to memory of 3572 4760 5F37.tmp 87 PID 3572 wrote to memory of 3932 3572 5FC3.tmp 88 PID 3572 wrote to memory of 3932 3572 5FC3.tmp 88 PID 3572 wrote to memory of 3932 3572 5FC3.tmp 88 PID 3932 wrote to memory of 2680 3932 608F.tmp 89 PID 3932 wrote to memory of 2680 3932 608F.tmp 89 PID 3932 wrote to memory of 2680 3932 608F.tmp 89 PID 2680 wrote to memory of 876 2680 613A.tmp 90 PID 2680 wrote to memory of 876 2680 613A.tmp 90 PID 2680 wrote to memory of 876 2680 613A.tmp 90 PID 876 wrote to memory of 2012 876 61C7.tmp 91 PID 876 wrote to memory of 2012 876 61C7.tmp 91 PID 876 wrote to memory of 2012 876 61C7.tmp 91 PID 2012 wrote to memory of 2008 2012 6254.tmp 92 PID 2012 wrote to memory of 2008 2012 6254.tmp 92 PID 2012 wrote to memory of 2008 2012 6254.tmp 92 PID 2008 wrote to memory of 1476 2008 634E.tmp 93 PID 2008 wrote to memory of 1476 2008 634E.tmp 93 PID 2008 wrote to memory of 1476 2008 634E.tmp 93 PID 1476 wrote to memory of 1020 1476 63FA.tmp 94 PID 1476 wrote to memory of 1020 1476 63FA.tmp 94 PID 1476 wrote to memory of 1020 1476 63FA.tmp 94 PID 1020 wrote to memory of 2676 1020 64C5.tmp 95 PID 1020 wrote to memory of 2676 1020 64C5.tmp 95 PID 1020 wrote to memory of 2676 1020 64C5.tmp 95 PID 2676 wrote to memory of 4960 2676 6571.tmp 96 PID 2676 wrote to memory of 4960 2676 6571.tmp 96 PID 2676 wrote to memory of 4960 2676 6571.tmp 96 PID 4960 wrote to memory of 4360 4960 65EE.tmp 97 PID 4960 wrote to memory of 4360 4960 65EE.tmp 97 PID 4960 wrote to memory of 4360 4960 65EE.tmp 97 PID 4360 wrote to memory of 1528 4360 66B9.tmp 98 PID 4360 wrote to memory of 1528 4360 66B9.tmp 98 PID 4360 wrote to memory of 1528 4360 66B9.tmp 98 PID 1528 wrote to memory of 5028 1528 6745.tmp 99 PID 1528 wrote to memory of 5028 1528 6745.tmp 99 PID 1528 wrote to memory of 5028 1528 6745.tmp 99 PID 5028 wrote to memory of 2492 5028 68CC.tmp 100 PID 5028 wrote to memory of 2492 5028 68CC.tmp 100 PID 5028 wrote to memory of 2492 5028 68CC.tmp 100 PID 2492 wrote to memory of 2332 2492 6959.tmp 103 PID 2492 wrote to memory of 2332 2492 6959.tmp 103 PID 2492 wrote to memory of 2332 2492 6959.tmp 103 PID 2332 wrote to memory of 2664 2332 69C6.tmp 104 PID 2332 wrote to memory of 2664 2332 69C6.tmp 104 PID 2332 wrote to memory of 2664 2332 69C6.tmp 104 PID 2664 wrote to memory of 4680 2664 6A53.tmp 105 PID 2664 wrote to memory of 4680 2664 6A53.tmp 105 PID 2664 wrote to memory of 4680 2664 6A53.tmp 105 PID 4680 wrote to memory of 2780 4680 6AFE.tmp 106 PID 4680 wrote to memory of 2780 4680 6AFE.tmp 106 PID 4680 wrote to memory of 2780 4680 6AFE.tmp 106 PID 2780 wrote to memory of 3372 2780 6B8B.tmp 107 PID 2780 wrote to memory of 3372 2780 6B8B.tmp 107 PID 2780 wrote to memory of 3372 2780 6B8B.tmp 107 PID 3372 wrote to memory of 996 3372 6C08.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_499ad3c570b8998c9eea443e73bf2ffb_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"23⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"24⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"25⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"26⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"27⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"28⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"29⤵
- Executes dropped EXE
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"30⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"31⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\72CE.tmp"C:\Users\Admin\AppData\Local\Temp\72CE.tmp"32⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"33⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"34⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"35⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"36⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"37⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"38⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"39⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"40⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"41⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"42⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"43⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"44⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"45⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"46⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"47⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"48⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"49⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"50⤵
- Executes dropped EXE
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"51⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"52⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"53⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"54⤵
- Executes dropped EXE
PID:856 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"55⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"56⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"57⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"58⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\8462.tmp"C:\Users\Admin\AppData\Local\Temp\8462.tmp"59⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"60⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"61⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"62⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"63⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"64⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"65⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"66⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"67⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"68⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"69⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"70⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"71⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"72⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"73⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"74⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"75⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"76⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"77⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"78⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"79⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"80⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"81⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"82⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"83⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"84⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"85⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"86⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"87⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"88⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"89⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"90⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"91⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"92⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"93⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"94⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"95⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"96⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"97⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"98⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"99⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"100⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"101⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"102⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"103⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"104⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"105⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"106⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"107⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"108⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"109⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"110⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"111⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"112⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"113⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"114⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"115⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"116⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"117⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"118⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"119⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"120⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"121⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"122⤵PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-