Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 03:35
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe
-
Size
520KB
-
MD5
3f104e16d1775e79f2b4797b0e641221
-
SHA1
b29fa33efb8fe7d666172989c5a6e8488e657fc6
-
SHA256
81df4ceab659100985f116a45650e611fd5a35d71e5f3d17c4cce965a1eb2acb
-
SHA512
57a0c1a6bade3e58d4c4742599c1beb915112d6d11e5a46d2ffd5d86c5f633c66af2e5d835f53131c0c993878828824fb3b6ab182537135f3f9c8a442c735048
-
SSDEEP
12288:gj8fuxR21t5i8f4DuSQt0tAu5/n1h9P0cwZNZ:gj8fuK1GY4Dur0yO/1D3wZN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2928 4F82.tmp 3300 52CE.tmp 3000 54E1.tmp 4824 55BC.tmp 1800 5772.tmp 1504 584C.tmp 1016 5A50.tmp 4412 5B4A.tmp 3460 5BF6.tmp 4340 5CB1.tmp 4788 5E96.tmp 1452 601C.tmp 2796 60F7.tmp 2252 625F.tmp 828 6349.tmp 3704 6414.tmp 5068 6647.tmp 2624 67AE.tmp 2144 685A.tmp 3036 6915.tmp 224 6A0F.tmp 5112 6C61.tmp 3944 6D0D.tmp 3384 6FCC.tmp 1648 7088.tmp 4944 7162.tmp 4352 72BA.tmp 4800 7395.tmp 1764 7460.tmp 2440 755A.tmp 1588 7615.tmp 3032 776D.tmp 2284 7819.tmp 2660 7896.tmp 3580 79AF.tmp 1992 7C20.tmp 1788 7C9D.tmp 1372 7D0B.tmp 3256 7D78.tmp 1916 7DE5.tmp 2980 8056.tmp 2136 80D3.tmp 4904 846D.tmp 1344 85C5.tmp 4104 8632.tmp 1540 871D.tmp 2568 879A.tmp 884 8894.tmp 4980 8911.tmp 2928 8A78.tmp 3700 8AE6.tmp 3752 8BE0.tmp 4176 8C4D.tmp 3552 8CBA.tmp 2344 8D28.tmp 1760 8F79.tmp 2380 9006.tmp 4132 911F.tmp 4412 91CB.tmp 3460 92E4.tmp 2840 93EE.tmp 1452 947B.tmp 2252 94F8.tmp 828 9575.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4980 wrote to memory of 2928 4980 2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe 85 PID 4980 wrote to memory of 2928 4980 2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe 85 PID 4980 wrote to memory of 2928 4980 2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe 85 PID 2928 wrote to memory of 3300 2928 4F82.tmp 86 PID 2928 wrote to memory of 3300 2928 4F82.tmp 86 PID 2928 wrote to memory of 3300 2928 4F82.tmp 86 PID 3300 wrote to memory of 3000 3300 52CE.tmp 87 PID 3300 wrote to memory of 3000 3300 52CE.tmp 87 PID 3300 wrote to memory of 3000 3300 52CE.tmp 87 PID 3000 wrote to memory of 4824 3000 54E1.tmp 88 PID 3000 wrote to memory of 4824 3000 54E1.tmp 88 PID 3000 wrote to memory of 4824 3000 54E1.tmp 88 PID 4824 wrote to memory of 1800 4824 55BC.tmp 89 PID 4824 wrote to memory of 1800 4824 55BC.tmp 89 PID 4824 wrote to memory of 1800 4824 55BC.tmp 89 PID 1800 wrote to memory of 1504 1800 5772.tmp 90 PID 1800 wrote to memory of 1504 1800 5772.tmp 90 PID 1800 wrote to memory of 1504 1800 5772.tmp 90 PID 1504 wrote to memory of 1016 1504 584C.tmp 91 PID 1504 wrote to memory of 1016 1504 584C.tmp 91 PID 1504 wrote to memory of 1016 1504 584C.tmp 91 PID 1016 wrote to memory of 4412 1016 5A50.tmp 92 PID 1016 wrote to memory of 4412 1016 5A50.tmp 92 PID 1016 wrote to memory of 4412 1016 5A50.tmp 92 PID 4412 wrote to memory of 3460 4412 5B4A.tmp 93 PID 4412 wrote to memory of 3460 4412 5B4A.tmp 93 PID 4412 wrote to memory of 3460 4412 5B4A.tmp 93 PID 3460 wrote to memory of 4340 3460 5BF6.tmp 94 PID 3460 wrote to memory of 4340 3460 5BF6.tmp 94 PID 3460 wrote to memory of 4340 3460 5BF6.tmp 94 PID 4340 wrote to memory of 4788 4340 5CB1.tmp 95 PID 4340 wrote to memory of 4788 4340 5CB1.tmp 95 PID 4340 wrote to memory of 4788 4340 5CB1.tmp 95 PID 4788 wrote to memory of 1452 4788 5E96.tmp 96 PID 4788 wrote to memory of 1452 4788 5E96.tmp 96 PID 4788 wrote to memory of 1452 4788 5E96.tmp 96 PID 1452 wrote to memory of 2796 1452 601C.tmp 97 PID 1452 wrote to memory of 2796 1452 601C.tmp 97 PID 1452 wrote to memory of 2796 1452 601C.tmp 97 PID 2796 wrote to memory of 2252 2796 60F7.tmp 98 PID 2796 wrote to memory of 2252 2796 60F7.tmp 98 PID 2796 wrote to memory of 2252 2796 60F7.tmp 98 PID 2252 wrote to memory of 828 2252 625F.tmp 99 PID 2252 wrote to memory of 828 2252 625F.tmp 99 PID 2252 wrote to memory of 828 2252 625F.tmp 99 PID 828 wrote to memory of 3704 828 6349.tmp 100 PID 828 wrote to memory of 3704 828 6349.tmp 100 PID 828 wrote to memory of 3704 828 6349.tmp 100 PID 3704 wrote to memory of 5068 3704 6414.tmp 101 PID 3704 wrote to memory of 5068 3704 6414.tmp 101 PID 3704 wrote to memory of 5068 3704 6414.tmp 101 PID 5068 wrote to memory of 2624 5068 6647.tmp 102 PID 5068 wrote to memory of 2624 5068 6647.tmp 102 PID 5068 wrote to memory of 2624 5068 6647.tmp 102 PID 2624 wrote to memory of 2144 2624 67AE.tmp 103 PID 2624 wrote to memory of 2144 2624 67AE.tmp 103 PID 2624 wrote to memory of 2144 2624 67AE.tmp 103 PID 2144 wrote to memory of 3036 2144 685A.tmp 104 PID 2144 wrote to memory of 3036 2144 685A.tmp 104 PID 2144 wrote to memory of 3036 2144 685A.tmp 104 PID 3036 wrote to memory of 224 3036 6915.tmp 105 PID 3036 wrote to memory of 224 3036 6915.tmp 105 PID 3036 wrote to memory of 224 3036 6915.tmp 105 PID 224 wrote to memory of 5112 224 6A0F.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-25_3f104e16d1775e79f2b4797b0e641221_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\601C.tmp"C:\Users\Admin\AppData\Local\Temp\601C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"23⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"24⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"25⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"26⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"27⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"28⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"29⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"30⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"31⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"32⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"33⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"34⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"35⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\79AF.tmp"C:\Users\Admin\AppData\Local\Temp\79AF.tmp"36⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"37⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"C:\Users\Admin\AppData\Local\Temp\7C9D.tmp"38⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"39⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"40⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"41⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"42⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"43⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"44⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"45⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"46⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"47⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\879A.tmp"C:\Users\Admin\AppData\Local\Temp\879A.tmp"48⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"49⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"50⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"51⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"52⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"53⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"54⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"55⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"C:\Users\Admin\AppData\Local\Temp\8CBA.tmp"56⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"57⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"58⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9006.tmp"C:\Users\Admin\AppData\Local\Temp\9006.tmp"59⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"60⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"61⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"62⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\93EE.tmp"C:\Users\Admin\AppData\Local\Temp\93EE.tmp"63⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"64⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"65⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9575.tmp"C:\Users\Admin\AppData\Local\Temp\9575.tmp"66⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"67⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"68⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\97E6.tmp"C:\Users\Admin\AppData\Local\Temp\97E6.tmp"69⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\99BA.tmp"C:\Users\Admin\AppData\Local\Temp\99BA.tmp"70⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"71⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"C:\Users\Admin\AppData\Local\Temp\9C7A.tmp"72⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"73⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\9D93.tmp"C:\Users\Admin\AppData\Local\Temp\9D93.tmp"74⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"75⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"76⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A090.tmp"C:\Users\Admin\AppData\Local\Temp\A090.tmp"77⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"78⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"79⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"C:\Users\Admin\AppData\Local\Temp\A2F2.tmp"80⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\A37E.tmp"C:\Users\Admin\AppData\Local\Temp\A37E.tmp"81⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A41B.tmp"C:\Users\Admin\AppData\Local\Temp\A41B.tmp"82⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"83⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"84⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"85⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"86⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"87⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"88⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"89⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"C:\Users\Admin\AppData\Local\Temp\A9A9.tmp"90⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"C:\Users\Admin\AppData\Local\Temp\AAC2.tmp"91⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"92⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"93⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"94⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"C:\Users\Admin\AppData\Local\Temp\ADBF.tmp"95⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"96⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"97⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"98⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"99⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"100⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"101⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"102⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"103⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B699.tmp"C:\Users\Admin\AppData\Local\Temp\B699.tmp"104⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"105⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"106⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"107⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"108⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"109⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"110⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"111⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\C241.tmp"C:\Users\Admin\AppData\Local\Temp\C241.tmp"112⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"113⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"115⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"116⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"117⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"118⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C668.tmp"C:\Users\Admin\AppData\Local\Temp\C668.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"120⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\C917.tmp"C:\Users\Admin\AppData\Local\Temp\C917.tmp"121⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"C:\Users\Admin\AppData\Local\Temp\C9C3.tmp"122⤵PID:1816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-