Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5efa0ab245e145423f34a5065a604f11_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5efa0ab245e145423f34a5065a604f11_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5efa0ab245e145423f34a5065a604f11_mafia_JC.exe
-
Size
520KB
-
MD5
5efa0ab245e145423f34a5065a604f11
-
SHA1
550b1ba0f0ebbb8bd214e26115ba6ea922a0dc11
-
SHA256
77d212367fbf2b3464717a82a8682678d16a1a5a67ee832022464225042a15b1
-
SHA512
ba9ded37ab2f8bd9df877f5b677a9fecb89adb31723432cdbb5d0ce25f71e76f9fef963e1ba732fad951a08d6e327ec1f6c60ccb7dfb122cab78ffb4972ec978
-
SSDEEP
12288:wtRBGdtByyhynRfy2hdQ5+cD4PA/4EirvXOl2ZLNZ:wtqdOyhyVlhdLtPm4EA/Ol2xN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3296 89E1.tmp 1084 8AAC.tmp 920 8B77.tmp 2884 8C71.tmp 2928 8D0D.tmp 2468 8DE8.tmp 4880 8E94.tmp 4244 8F40.tmp 464 8FCC.tmp 1984 9069.tmp 4728 9124.tmp 3376 91E0.tmp 5092 92AB.tmp 1308 9366.tmp 4280 9460.tmp 3984 94FC.tmp 4848 95A8.tmp 1480 9683.tmp 4520 976D.tmp 1868 9829.tmp 4428 9904.tmp 2788 99A0.tmp 4780 9A2D.tmp 4324 9AAA.tmp 2216 9B65.tmp 3312 9C21.tmp 1560 9CCC.tmp 3188 9D98.tmp 1920 9E43.tmp 2344 9F3D.tmp 2784 A009.tmp 4084 A0C4.tmp 1268 A1AE.tmp 2684 A22B.tmp 4540 A2A8.tmp 116 A325.tmp 5036 A3A2.tmp 4988 A46E.tmp 4876 A4DB.tmp 4640 A558.tmp 2864 A5E5.tmp 3940 A652.tmp 2172 A6B0.tmp 3260 A71D.tmp 1400 A79A.tmp 4472 A827.tmp 3984 A8A4.tmp 4796 A930.tmp 1708 AA3A.tmp 1064 AAD6.tmp 3316 AB53.tmp 4296 ABD0.tmp 4632 AC2E.tmp 3916 ACAB.tmp 2920 AD28.tmp 4292 AD95.tmp 3552 AE12.tmp 4460 AE8F.tmp 2412 AEFD.tmp 2732 AF6A.tmp 2216 AFD7.tmp 3312 B045.tmp 3960 B0C2.tmp 3716 B110.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 3296 4568 5efa0ab245e145423f34a5065a604f11_mafia_JC.exe 84 PID 4568 wrote to memory of 3296 4568 5efa0ab245e145423f34a5065a604f11_mafia_JC.exe 84 PID 4568 wrote to memory of 3296 4568 5efa0ab245e145423f34a5065a604f11_mafia_JC.exe 84 PID 3296 wrote to memory of 1084 3296 89E1.tmp 85 PID 3296 wrote to memory of 1084 3296 89E1.tmp 85 PID 3296 wrote to memory of 1084 3296 89E1.tmp 85 PID 1084 wrote to memory of 920 1084 8AAC.tmp 86 PID 1084 wrote to memory of 920 1084 8AAC.tmp 86 PID 1084 wrote to memory of 920 1084 8AAC.tmp 86 PID 920 wrote to memory of 2884 920 8B77.tmp 87 PID 920 wrote to memory of 2884 920 8B77.tmp 87 PID 920 wrote to memory of 2884 920 8B77.tmp 87 PID 2884 wrote to memory of 2928 2884 8C71.tmp 88 PID 2884 wrote to memory of 2928 2884 8C71.tmp 88 PID 2884 wrote to memory of 2928 2884 8C71.tmp 88 PID 2928 wrote to memory of 2468 2928 8D0D.tmp 89 PID 2928 wrote to memory of 2468 2928 8D0D.tmp 89 PID 2928 wrote to memory of 2468 2928 8D0D.tmp 89 PID 2468 wrote to memory of 4880 2468 8DE8.tmp 90 PID 2468 wrote to memory of 4880 2468 8DE8.tmp 90 PID 2468 wrote to memory of 4880 2468 8DE8.tmp 90 PID 4880 wrote to memory of 4244 4880 8E94.tmp 92 PID 4880 wrote to memory of 4244 4880 8E94.tmp 92 PID 4880 wrote to memory of 4244 4880 8E94.tmp 92 PID 4244 wrote to memory of 464 4244 8F40.tmp 93 PID 4244 wrote to memory of 464 4244 8F40.tmp 93 PID 4244 wrote to memory of 464 4244 8F40.tmp 93 PID 464 wrote to memory of 1984 464 8FCC.tmp 94 PID 464 wrote to memory of 1984 464 8FCC.tmp 94 PID 464 wrote to memory of 1984 464 8FCC.tmp 94 PID 1984 wrote to memory of 4728 1984 9069.tmp 95 PID 1984 wrote to memory of 4728 1984 9069.tmp 95 PID 1984 wrote to memory of 4728 1984 9069.tmp 95 PID 4728 wrote to memory of 3376 4728 9124.tmp 96 PID 4728 wrote to memory of 3376 4728 9124.tmp 96 PID 4728 wrote to memory of 3376 4728 9124.tmp 96 PID 3376 wrote to memory of 5092 3376 91E0.tmp 97 PID 3376 wrote to memory of 5092 3376 91E0.tmp 97 PID 3376 wrote to memory of 5092 3376 91E0.tmp 97 PID 5092 wrote to memory of 1308 5092 92AB.tmp 98 PID 5092 wrote to memory of 1308 5092 92AB.tmp 98 PID 5092 wrote to memory of 1308 5092 92AB.tmp 98 PID 1308 wrote to memory of 4280 1308 9366.tmp 99 PID 1308 wrote to memory of 4280 1308 9366.tmp 99 PID 1308 wrote to memory of 4280 1308 9366.tmp 99 PID 4280 wrote to memory of 3984 4280 9460.tmp 100 PID 4280 wrote to memory of 3984 4280 9460.tmp 100 PID 4280 wrote to memory of 3984 4280 9460.tmp 100 PID 3984 wrote to memory of 4848 3984 94FC.tmp 101 PID 3984 wrote to memory of 4848 3984 94FC.tmp 101 PID 3984 wrote to memory of 4848 3984 94FC.tmp 101 PID 4848 wrote to memory of 1480 4848 95A8.tmp 102 PID 4848 wrote to memory of 1480 4848 95A8.tmp 102 PID 4848 wrote to memory of 1480 4848 95A8.tmp 102 PID 1480 wrote to memory of 4520 1480 9683.tmp 105 PID 1480 wrote to memory of 4520 1480 9683.tmp 105 PID 1480 wrote to memory of 4520 1480 9683.tmp 105 PID 4520 wrote to memory of 1868 4520 976D.tmp 106 PID 4520 wrote to memory of 1868 4520 976D.tmp 106 PID 4520 wrote to memory of 1868 4520 976D.tmp 106 PID 1868 wrote to memory of 4428 1868 9829.tmp 107 PID 1868 wrote to memory of 4428 1868 9829.tmp 107 PID 1868 wrote to memory of 4428 1868 9829.tmp 107 PID 4428 wrote to memory of 2788 4428 9904.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5efa0ab245e145423f34a5065a604f11_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5efa0ab245e145423f34a5065a604f11_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"C:\Users\Admin\AppData\Local\Temp\8AAC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"23⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"24⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"25⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"26⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"27⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"28⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"29⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"30⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"31⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"32⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"33⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"34⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"35⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"36⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"37⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"38⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"39⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"40⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"41⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"42⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"43⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"44⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"45⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"46⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"47⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"48⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"49⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"50⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"51⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"52⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"53⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"54⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"55⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"56⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"57⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"58⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"59⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"60⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"61⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"62⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"63⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"64⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"65⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"66⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"67⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"68⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"70⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"71⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"72⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"73⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"74⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"75⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"76⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"77⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\B621.tmp"C:\Users\Admin\AppData\Local\Temp\B621.tmp"78⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"79⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"80⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"81⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"82⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"83⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"84⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"85⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"86⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"87⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"88⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"89⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"90⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"91⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"92⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"93⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"94⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"95⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"96⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"97⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"98⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"99⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"100⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"101⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"102⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"103⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"104⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"105⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"106⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"107⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"108⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"109⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"110⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\C573.tmp"C:\Users\Admin\AppData\Local\Temp\C573.tmp"111⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"112⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"113⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"114⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"115⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"116⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"117⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"118⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"119⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"C:\Users\Admin\AppData\Local\Temp\CAC2.tmp"120⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"121⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-