Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 12:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe
-
Size
487KB
-
MD5
5657b34b5a4f8713d4d23d4a29f7a74f
-
SHA1
5bc07f00fd4768cc8e5bdffb6021fc7fb73f72e5
-
SHA256
1d63e7ed71e5d1f59c9fc743302b797d8f666693be8bd934dde464800e004bd5
-
SHA512
07505134a093296f3a74667794f6f4d9f2497299b419c6d53909708e26bd29dab842ff3fbd263d19deedd91f1f2d4258b366ddc56d68328efdb7c292a09c6747
-
SSDEEP
12288:yU5rCOTeiNRx+N7TRpgIFnVFZxNXeth1I7bZ:yUQOJN3+N7DZx1etrI7b
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1624 7C15.tmp 1300 7CC1.tmp 3936 7DAC.tmp 4192 7E86.tmp 4632 7F13.tmp 2964 7FFD.tmp 1536 80D8.tmp 4816 8174.tmp 4976 8211.tmp 3444 82BD.tmp 4384 8359.tmp 1820 8453.tmp 2888 853D.tmp 3128 8637.tmp 4780 8702.tmp 4656 87ED.tmp 2240 8889.tmp 1672 8916.tmp 4688 89C1.tmp 2320 8ABB.tmp 1988 8B58.tmp 3080 8C52.tmp 1712 8CDE.tmp 2060 8D6B.tmp 3324 8DE8.tmp 1384 8E94.tmp 564 8F4F.tmp 4376 8FDC.tmp 728 9088.tmp 4748 9172.tmp 2852 927C.tmp 3616 92F9.tmp 4628 93E3.tmp 3588 948F.tmp 4868 94FC.tmp 4304 9589.tmp 764 9616.tmp 828 96A2.tmp 4620 975E.tmp 1640 97EA.tmp 1540 9877.tmp 2500 98F4.tmp 4692 9990.tmp 1644 9A0D.tmp 4516 9A8A.tmp 2040 9B94.tmp 860 9C21.tmp 1092 9CBD.tmp 3596 9D69.tmp 1624 9E34.tmp 636 9ED0.tmp 3868 9F5D.tmp 2416 9FF9.tmp 756 A086.tmp 3480 A0F3.tmp 3780 A19F.tmp 2756 A22B.tmp 1360 A2A8.tmp 1888 A335.tmp 4600 A3A2.tmp 2464 A43F.tmp 4976 A4EB.tmp 3192 A596.tmp 1316 A623.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1624 4792 5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe 81 PID 4792 wrote to memory of 1624 4792 5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe 81 PID 4792 wrote to memory of 1624 4792 5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe 81 PID 1624 wrote to memory of 1300 1624 7C15.tmp 82 PID 1624 wrote to memory of 1300 1624 7C15.tmp 82 PID 1624 wrote to memory of 1300 1624 7C15.tmp 82 PID 1300 wrote to memory of 3936 1300 7CC1.tmp 83 PID 1300 wrote to memory of 3936 1300 7CC1.tmp 83 PID 1300 wrote to memory of 3936 1300 7CC1.tmp 83 PID 3936 wrote to memory of 4192 3936 7DAC.tmp 84 PID 3936 wrote to memory of 4192 3936 7DAC.tmp 84 PID 3936 wrote to memory of 4192 3936 7DAC.tmp 84 PID 4192 wrote to memory of 4632 4192 7E86.tmp 85 PID 4192 wrote to memory of 4632 4192 7E86.tmp 85 PID 4192 wrote to memory of 4632 4192 7E86.tmp 85 PID 4632 wrote to memory of 2964 4632 7F13.tmp 86 PID 4632 wrote to memory of 2964 4632 7F13.tmp 86 PID 4632 wrote to memory of 2964 4632 7F13.tmp 86 PID 2964 wrote to memory of 1536 2964 7FFD.tmp 87 PID 2964 wrote to memory of 1536 2964 7FFD.tmp 87 PID 2964 wrote to memory of 1536 2964 7FFD.tmp 87 PID 1536 wrote to memory of 4816 1536 80D8.tmp 88 PID 1536 wrote to memory of 4816 1536 80D8.tmp 88 PID 1536 wrote to memory of 4816 1536 80D8.tmp 88 PID 4816 wrote to memory of 4976 4816 8174.tmp 89 PID 4816 wrote to memory of 4976 4816 8174.tmp 89 PID 4816 wrote to memory of 4976 4816 8174.tmp 89 PID 4976 wrote to memory of 3444 4976 8211.tmp 91 PID 4976 wrote to memory of 3444 4976 8211.tmp 91 PID 4976 wrote to memory of 3444 4976 8211.tmp 91 PID 3444 wrote to memory of 4384 3444 82BD.tmp 92 PID 3444 wrote to memory of 4384 3444 82BD.tmp 92 PID 3444 wrote to memory of 4384 3444 82BD.tmp 92 PID 4384 wrote to memory of 1820 4384 8359.tmp 93 PID 4384 wrote to memory of 1820 4384 8359.tmp 93 PID 4384 wrote to memory of 1820 4384 8359.tmp 93 PID 1820 wrote to memory of 2888 1820 8453.tmp 94 PID 1820 wrote to memory of 2888 1820 8453.tmp 94 PID 1820 wrote to memory of 2888 1820 8453.tmp 94 PID 2888 wrote to memory of 3128 2888 853D.tmp 95 PID 2888 wrote to memory of 3128 2888 853D.tmp 95 PID 2888 wrote to memory of 3128 2888 853D.tmp 95 PID 3128 wrote to memory of 4780 3128 8637.tmp 96 PID 3128 wrote to memory of 4780 3128 8637.tmp 96 PID 3128 wrote to memory of 4780 3128 8637.tmp 96 PID 4780 wrote to memory of 4656 4780 8702.tmp 97 PID 4780 wrote to memory of 4656 4780 8702.tmp 97 PID 4780 wrote to memory of 4656 4780 8702.tmp 97 PID 4656 wrote to memory of 2240 4656 87ED.tmp 98 PID 4656 wrote to memory of 2240 4656 87ED.tmp 98 PID 4656 wrote to memory of 2240 4656 87ED.tmp 98 PID 2240 wrote to memory of 1672 2240 8889.tmp 99 PID 2240 wrote to memory of 1672 2240 8889.tmp 99 PID 2240 wrote to memory of 1672 2240 8889.tmp 99 PID 1672 wrote to memory of 4688 1672 8916.tmp 102 PID 1672 wrote to memory of 4688 1672 8916.tmp 102 PID 1672 wrote to memory of 4688 1672 8916.tmp 102 PID 4688 wrote to memory of 2320 4688 89C1.tmp 103 PID 4688 wrote to memory of 2320 4688 89C1.tmp 103 PID 4688 wrote to memory of 2320 4688 89C1.tmp 103 PID 2320 wrote to memory of 1988 2320 8ABB.tmp 104 PID 2320 wrote to memory of 1988 2320 8ABB.tmp 104 PID 2320 wrote to memory of 1988 2320 8ABB.tmp 104 PID 1988 wrote to memory of 3080 1988 8B58.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5657b34b5a4f8713d4d23d4a29f7a74f_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\7F13.tmp"C:\Users\Admin\AppData\Local\Temp\7F13.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"23⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"24⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"25⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"26⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"27⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"28⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"29⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"30⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"31⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"32⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"33⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"34⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"35⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"36⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"37⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"38⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"39⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"40⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"41⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"42⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"43⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"44⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"45⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"46⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"47⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"48⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"49⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"50⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"51⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"52⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"53⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"54⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"55⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"56⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"57⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"58⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"59⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"60⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"61⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"C:\Users\Admin\AppData\Local\Temp\A3A2.tmp"62⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"63⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"64⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"65⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"66⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"67⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"68⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"69⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"70⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"71⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"72⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"73⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"74⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"75⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"76⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"77⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"78⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"79⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"80⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"81⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"82⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"83⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"84⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"85⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"86⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"87⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"88⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"89⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"90⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"91⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"92⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"93⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"94⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"95⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"96⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"97⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"98⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"99⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"100⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"101⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B815.tmp"C:\Users\Admin\AppData\Local\Temp\B815.tmp"102⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"104⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"105⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"106⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"107⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"108⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"109⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"110⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"111⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"112⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"113⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"114⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"115⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"116⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"117⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"118⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"119⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"120⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"121⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-