Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 15:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe
Resource
win10v2004-20230703-en
3 signatures
150 seconds
General
-
Target
2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe
-
Size
486KB
-
MD5
2a63eb04eb5a5eb2fc5c3d1175fbfb9f
-
SHA1
148bf1762ae5a6a6bfd0a5838846bafe1932aebc
-
SHA256
7b70b018433a43af13d4a8578d0c472d7ec4ddce63936c809cf3c1a3d140732e
-
SHA512
e1c30ecfaa2562ae5c3d6da74e14d011affbbbef97049798d8e170690990be8fa72a546210dd46c9735fa81ba45aeb2f6bf98d2bfe8b9e14fec874090c38ea4a
-
SSDEEP
12288:/U5rCOTeiDr620bb8uubXc+PNprnPTExiqNZ:/UQOJD3Dw+rI4qN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 624 825F.tmp 1972 830B.tmp 4180 83B7.tmp 2568 8491.tmp 4396 854D.tmp 2932 85F9.tmp 1648 8695.tmp 1168 8741.tmp 2236 87FC.tmp 2908 88A8.tmp 4060 8944.tmp 4380 8A7D.tmp 2864 8B19.tmp 3264 8B87.tmp 1348 8C42.tmp 1028 8CFE.tmp 3308 8D9A.tmp 4128 8E46.tmp 2828 8F8E.tmp 4468 9049.tmp 4320 9105.tmp 2176 9191.tmp 2524 920E.tmp 1528 92AB.tmp 4220 9357.tmp 1620 93C4.tmp 4552 948F.tmp 4100 9589.tmp 1428 9683.tmp 2060 979C.tmp 4444 9867.tmp 3712 9942.tmp 4904 9A3C.tmp 2748 9AC9.tmp 2568 9B84.tmp 2380 9C30.tmp 2504 9CDC.tmp 1016 9D59.tmp 3600 9E53.tmp 2560 9ED0.tmp 3572 9F7C.tmp 2580 9FF9.tmp 3736 A0A5.tmp 2624 A131.tmp 1980 A1CE.tmp 1992 A25A.tmp 4380 A2F7.tmp 1464 A374.tmp 4324 A3F1.tmp 4768 A49C.tmp 3380 A529.tmp 1968 A596.tmp 4828 A604.tmp 4476 A671.tmp 4984 A6EE.tmp 1028 A77B.tmp 3308 A7F8.tmp 4068 A894.tmp 2192 A911.tmp 2828 A99E.tmp 2976 AA3A.tmp 2288 AA98.tmp 3196 AB05.tmp 4472 AB53.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{796FBB70-365B-4070-9233-64805E157260}.catalogItem svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 624 4028 2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe 87 PID 4028 wrote to memory of 624 4028 2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe 87 PID 4028 wrote to memory of 624 4028 2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe 87 PID 624 wrote to memory of 1972 624 825F.tmp 88 PID 624 wrote to memory of 1972 624 825F.tmp 88 PID 624 wrote to memory of 1972 624 825F.tmp 88 PID 1972 wrote to memory of 4180 1972 830B.tmp 89 PID 1972 wrote to memory of 4180 1972 830B.tmp 89 PID 1972 wrote to memory of 4180 1972 830B.tmp 89 PID 4180 wrote to memory of 2568 4180 83B7.tmp 90 PID 4180 wrote to memory of 2568 4180 83B7.tmp 90 PID 4180 wrote to memory of 2568 4180 83B7.tmp 90 PID 2568 wrote to memory of 4396 2568 8491.tmp 91 PID 2568 wrote to memory of 4396 2568 8491.tmp 91 PID 2568 wrote to memory of 4396 2568 8491.tmp 91 PID 4396 wrote to memory of 2932 4396 854D.tmp 92 PID 4396 wrote to memory of 2932 4396 854D.tmp 92 PID 4396 wrote to memory of 2932 4396 854D.tmp 92 PID 2932 wrote to memory of 1648 2932 85F9.tmp 93 PID 2932 wrote to memory of 1648 2932 85F9.tmp 93 PID 2932 wrote to memory of 1648 2932 85F9.tmp 93 PID 1648 wrote to memory of 1168 1648 8695.tmp 94 PID 1648 wrote to memory of 1168 1648 8695.tmp 94 PID 1648 wrote to memory of 1168 1648 8695.tmp 94 PID 1168 wrote to memory of 2236 1168 8741.tmp 95 PID 1168 wrote to memory of 2236 1168 8741.tmp 95 PID 1168 wrote to memory of 2236 1168 8741.tmp 95 PID 2236 wrote to memory of 2908 2236 87FC.tmp 96 PID 2236 wrote to memory of 2908 2236 87FC.tmp 96 PID 2236 wrote to memory of 2908 2236 87FC.tmp 96 PID 2908 wrote to memory of 4060 2908 88A8.tmp 97 PID 2908 wrote to memory of 4060 2908 88A8.tmp 97 PID 2908 wrote to memory of 4060 2908 88A8.tmp 97 PID 4060 wrote to memory of 4380 4060 8944.tmp 98 PID 4060 wrote to memory of 4380 4060 8944.tmp 98 PID 4060 wrote to memory of 4380 4060 8944.tmp 98 PID 4380 wrote to memory of 2864 4380 8A7D.tmp 99 PID 4380 wrote to memory of 2864 4380 8A7D.tmp 99 PID 4380 wrote to memory of 2864 4380 8A7D.tmp 99 PID 2864 wrote to memory of 3264 2864 8B19.tmp 100 PID 2864 wrote to memory of 3264 2864 8B19.tmp 100 PID 2864 wrote to memory of 3264 2864 8B19.tmp 100 PID 3264 wrote to memory of 1348 3264 8B87.tmp 101 PID 3264 wrote to memory of 1348 3264 8B87.tmp 101 PID 3264 wrote to memory of 1348 3264 8B87.tmp 101 PID 1348 wrote to memory of 1028 1348 8C42.tmp 102 PID 1348 wrote to memory of 1028 1348 8C42.tmp 102 PID 1348 wrote to memory of 1028 1348 8C42.tmp 102 PID 1028 wrote to memory of 3308 1028 8CFE.tmp 105 PID 1028 wrote to memory of 3308 1028 8CFE.tmp 105 PID 1028 wrote to memory of 3308 1028 8CFE.tmp 105 PID 3308 wrote to memory of 4128 3308 8D9A.tmp 106 PID 3308 wrote to memory of 4128 3308 8D9A.tmp 106 PID 3308 wrote to memory of 4128 3308 8D9A.tmp 106 PID 4128 wrote to memory of 2828 4128 8E46.tmp 108 PID 4128 wrote to memory of 2828 4128 8E46.tmp 108 PID 4128 wrote to memory of 2828 4128 8E46.tmp 108 PID 2828 wrote to memory of 4468 2828 8F8E.tmp 109 PID 2828 wrote to memory of 4468 2828 8F8E.tmp 109 PID 2828 wrote to memory of 4468 2828 8F8E.tmp 109 PID 4468 wrote to memory of 4320 4468 9049.tmp 110 PID 4468 wrote to memory of 4320 4468 9049.tmp 110 PID 4468 wrote to memory of 4320 4468 9049.tmp 110 PID 4320 wrote to memory of 2176 4320 9105.tmp 111
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:4844
-
C:\Users\Admin\AppData\Local\Temp\2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2a63eb04eb5a5eb2fc5c3d1175fbfb9f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"23⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"24⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"25⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"26⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"27⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"28⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"29⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"30⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"31⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"32⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"33⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"34⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"35⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"36⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"37⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"38⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"39⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"40⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"41⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"42⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"43⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"44⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"45⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"46⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"47⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"48⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"49⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"50⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"51⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"52⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"53⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"54⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"55⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"56⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"57⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"58⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"59⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"60⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"61⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"62⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"63⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"64⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"65⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"66⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"67⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"68⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"69⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"70⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"71⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"72⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"73⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"74⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"75⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"76⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"77⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"78⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"79⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"80⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"81⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"82⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"83⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"84⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"85⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"87⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"88⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"89⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"90⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"91⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"92⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"93⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"94⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"95⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"96⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"97⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"98⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"99⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"100⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"101⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"102⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"103⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"104⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"106⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"107⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"108⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"109⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"110⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"111⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"112⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"113⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"114⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"115⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"116⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"117⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"118⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"119⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"120⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"121⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-