Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 15:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe
-
Size
486KB
-
MD5
1627b652f22d8e97f812cf54d3ccaf78
-
SHA1
0b69fd3d46a138330b8469500536de8af1533a5c
-
SHA256
79f1ffe236f62afa1368533bfe75f7b7be9cbe4a0e622ce107a333012e7896c7
-
SHA512
f2e257e1cd748e50d5108bf1cfad5cb2b5ecf77e8ce0bc6807945eee6ec6e117f6fd0617d70e91fc1de5c5c9a4710bc6a2b32fd4f9ec3472cf89c2ba6c48a590
-
SSDEEP
12288:oU5rCOTeiDeML5vGVo7jOHaf7igf/nlFlSNZ:oUQOJDPNGVonOHuOgf/rlSN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2596 8A1F.tmp 2280 8ADB.tmp 3512 8B87.tmp 2156 8FAD.tmp 2540 9049.tmp 3128 9105.tmp 4120 91FF.tmp 4260 929B.tmp 1648 9347.tmp 3632 93D4.tmp 4032 9451.tmp 3468 94CE.tmp 3260 956A.tmp 4312 9616.tmp 4016 96A2.tmp 1268 979C.tmp 220 9848.tmp 212 98F4.tmp 1684 9990.tmp 1260 9A8A.tmp 1604 9B46.tmp 2868 9BE2.tmp 2084 9CBD.tmp 3144 9D69.tmp 2608 9E05.tmp 4688 9EC0.tmp 2860 9F5D.tmp 1112 9FF9.tmp 1772 A095.tmp 3848 A131.tmp 2020 A21C.tmp 3384 A2A8.tmp 1120 A374.tmp 4572 A410.tmp 3092 A47D.tmp 1032 A519.tmp 4220 A5B6.tmp 624 A652.tmp 3272 A6DF.tmp 4256 A76B.tmp 4284 A817.tmp 4872 A8B3.tmp 2204 A950.tmp 2504 A9CD.tmp 4404 AA69.tmp 336 AB24.tmp 2596 ABC1.tmp 4332 AC3E.tmp 2004 ACE9.tmp 2200 AD86.tmp 3044 AE22.tmp 1132 AE9F.tmp 4736 AF2C.tmp 1196 AFB8.tmp 1652 B035.tmp 2948 B0D1.tmp 2396 B13F.tmp 1400 B1BC.tmp 1780 B248.tmp 2156 B2E5.tmp 844 B352.tmp 4980 B3DF.tmp 2368 B46B.tmp 1964 B4E8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 2596 3880 1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe 81 PID 3880 wrote to memory of 2596 3880 1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe 81 PID 3880 wrote to memory of 2596 3880 1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe 81 PID 2596 wrote to memory of 2280 2596 8A1F.tmp 82 PID 2596 wrote to memory of 2280 2596 8A1F.tmp 82 PID 2596 wrote to memory of 2280 2596 8A1F.tmp 82 PID 2280 wrote to memory of 3512 2280 8ADB.tmp 83 PID 2280 wrote to memory of 3512 2280 8ADB.tmp 83 PID 2280 wrote to memory of 3512 2280 8ADB.tmp 83 PID 3512 wrote to memory of 2156 3512 8B87.tmp 84 PID 3512 wrote to memory of 2156 3512 8B87.tmp 84 PID 3512 wrote to memory of 2156 3512 8B87.tmp 84 PID 2156 wrote to memory of 2540 2156 8FAD.tmp 85 PID 2156 wrote to memory of 2540 2156 8FAD.tmp 85 PID 2156 wrote to memory of 2540 2156 8FAD.tmp 85 PID 2540 wrote to memory of 3128 2540 9049.tmp 86 PID 2540 wrote to memory of 3128 2540 9049.tmp 86 PID 2540 wrote to memory of 3128 2540 9049.tmp 86 PID 3128 wrote to memory of 4120 3128 9105.tmp 87 PID 3128 wrote to memory of 4120 3128 9105.tmp 87 PID 3128 wrote to memory of 4120 3128 9105.tmp 87 PID 4120 wrote to memory of 4260 4120 91FF.tmp 88 PID 4120 wrote to memory of 4260 4120 91FF.tmp 88 PID 4120 wrote to memory of 4260 4120 91FF.tmp 88 PID 4260 wrote to memory of 1648 4260 929B.tmp 89 PID 4260 wrote to memory of 1648 4260 929B.tmp 89 PID 4260 wrote to memory of 1648 4260 929B.tmp 89 PID 1648 wrote to memory of 3632 1648 9347.tmp 91 PID 1648 wrote to memory of 3632 1648 9347.tmp 91 PID 1648 wrote to memory of 3632 1648 9347.tmp 91 PID 3632 wrote to memory of 4032 3632 93D4.tmp 92 PID 3632 wrote to memory of 4032 3632 93D4.tmp 92 PID 3632 wrote to memory of 4032 3632 93D4.tmp 92 PID 4032 wrote to memory of 3468 4032 9451.tmp 93 PID 4032 wrote to memory of 3468 4032 9451.tmp 93 PID 4032 wrote to memory of 3468 4032 9451.tmp 93 PID 3468 wrote to memory of 3260 3468 94CE.tmp 94 PID 3468 wrote to memory of 3260 3468 94CE.tmp 94 PID 3468 wrote to memory of 3260 3468 94CE.tmp 94 PID 3260 wrote to memory of 4312 3260 956A.tmp 95 PID 3260 wrote to memory of 4312 3260 956A.tmp 95 PID 3260 wrote to memory of 4312 3260 956A.tmp 95 PID 4312 wrote to memory of 4016 4312 9616.tmp 96 PID 4312 wrote to memory of 4016 4312 9616.tmp 96 PID 4312 wrote to memory of 4016 4312 9616.tmp 96 PID 4016 wrote to memory of 1268 4016 96A2.tmp 97 PID 4016 wrote to memory of 1268 4016 96A2.tmp 97 PID 4016 wrote to memory of 1268 4016 96A2.tmp 97 PID 1268 wrote to memory of 220 1268 979C.tmp 98 PID 1268 wrote to memory of 220 1268 979C.tmp 98 PID 1268 wrote to memory of 220 1268 979C.tmp 98 PID 220 wrote to memory of 212 220 9848.tmp 101 PID 220 wrote to memory of 212 220 9848.tmp 101 PID 220 wrote to memory of 212 220 9848.tmp 101 PID 212 wrote to memory of 1684 212 98F4.tmp 102 PID 212 wrote to memory of 1684 212 98F4.tmp 102 PID 212 wrote to memory of 1684 212 98F4.tmp 102 PID 1684 wrote to memory of 1260 1684 9990.tmp 103 PID 1684 wrote to memory of 1260 1684 9990.tmp 103 PID 1684 wrote to memory of 1260 1684 9990.tmp 103 PID 1260 wrote to memory of 1604 1260 9A8A.tmp 104 PID 1260 wrote to memory of 1604 1260 9A8A.tmp 104 PID 1260 wrote to memory of 1604 1260 9A8A.tmp 104 PID 1604 wrote to memory of 2868 1604 9B46.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\1627b652f22d8e97f812cf54d3ccaf78_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"23⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"24⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"25⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"26⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"C:\Users\Admin\AppData\Local\Temp\9EC0.tmp"27⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"28⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"29⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"30⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"31⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"32⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"33⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"34⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"35⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"36⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"37⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"38⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"39⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"40⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"41⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"42⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"43⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"44⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"45⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"46⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"47⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"48⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"49⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"C:\Users\Admin\AppData\Local\Temp\ACE9.tmp"50⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"51⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"52⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"53⤵
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"54⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"55⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"56⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"57⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"58⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"59⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"60⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"61⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"62⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"63⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"64⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"65⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"66⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"67⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"68⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"69⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"70⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"71⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"72⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"73⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"74⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"75⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"76⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"77⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"78⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"79⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"80⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"81⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"82⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"83⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"84⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"85⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"86⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"87⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"88⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"89⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"90⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"91⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"92⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"93⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"94⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"95⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"96⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"97⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"98⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"99⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"100⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"101⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"C:\Users\Admin\AppData\Local\Temp\C6F9.tmp"102⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"103⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"105⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"106⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"108⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"109⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"110⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"111⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"112⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"113⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"C:\Users\Admin\AppData\Local\Temp\CCF5.tmp"114⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"115⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"116⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"117⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"118⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"119⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"120⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"C:\Users\Admin\AppData\Local\Temp\D0DD.tmp"121⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"122⤵PID:4848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-