Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe
-
Size
527KB
-
MD5
5e3cdb1c4a6274c6bf75b27f8cabb1e9
-
SHA1
b28e4dc0f6fd4ae1964e86c9b1087211674dcd0e
-
SHA256
fa82359cf99c7b45133c61045287f24c3d8d9dad3bc0a197e98c2b61ad0001cc
-
SHA512
816bd234384448df7c20382a1d905a21d2a0143e2e537add58a683baf64dcb30aac16da46268072bfe679c1f1085fa66e9c0a5e1b04e41b2b73a1bba92608f77
-
SSDEEP
12288:fU5rCOTeidiW0XuRRuz2fXRN9pC9NYR0VQD9bDZu:fUQOJdiW0+boUB7w9mR1bDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4808 6C18.tmp 3068 6CE3.tmp 2276 6D9E.tmp 732 6E98.tmp 4708 6F44.tmp 3836 6FD1.tmp 4520 707D.tmp 2636 7203.tmp 3640 72DE.tmp 2424 73D8.tmp 400 74A3.tmp 5048 757E.tmp 5084 7688.tmp 4688 7753.tmp 2300 77FF.tmp 2592 78E9.tmp 4464 79B4.tmp 3736 7A70.tmp 1392 7BD7.tmp 3616 7C64.tmp 1688 7D00.tmp 2860 7D9C.tmp 4380 7E09.tmp 628 7EA6.tmp 1456 7F80.tmp 4104 801D.tmp 3732 80A9.tmp 3984 81C3.tmp 3380 829D.tmp 2828 83A7.tmp 4332 8491.tmp 428 853D.tmp 1900 8637.tmp 4600 8702.tmp 4036 8770.tmp 464 880C.tmp 3340 8899.tmp 748 8935.tmp 5072 89A2.tmp 904 8A3E.tmp 3060 8ABB.tmp 3924 8B58.tmp 1364 8BE4.tmp 688 8C90.tmp 2268 8D1D.tmp 3148 8DC9.tmp 2184 8E65.tmp 2160 8EF2.tmp 4964 8F7E.tmp 2296 8FFB.tmp 4196 9097.tmp 3540 9134.tmp 4372 91B1.tmp 4832 920E.tmp 4716 92AB.tmp 1576 9328.tmp 4720 93A5.tmp 1000 9431.tmp 1532 94DD.tmp 1144 9579.tmp 60 95F6.tmp 4168 96B2.tmp 1992 972F.tmp 4972 97AC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 4808 1956 5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe 82 PID 1956 wrote to memory of 4808 1956 5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe 82 PID 1956 wrote to memory of 4808 1956 5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe 82 PID 4808 wrote to memory of 3068 4808 6C18.tmp 83 PID 4808 wrote to memory of 3068 4808 6C18.tmp 83 PID 4808 wrote to memory of 3068 4808 6C18.tmp 83 PID 3068 wrote to memory of 2276 3068 6CE3.tmp 84 PID 3068 wrote to memory of 2276 3068 6CE3.tmp 84 PID 3068 wrote to memory of 2276 3068 6CE3.tmp 84 PID 2276 wrote to memory of 732 2276 6D9E.tmp 85 PID 2276 wrote to memory of 732 2276 6D9E.tmp 85 PID 2276 wrote to memory of 732 2276 6D9E.tmp 85 PID 732 wrote to memory of 4708 732 6E98.tmp 86 PID 732 wrote to memory of 4708 732 6E98.tmp 86 PID 732 wrote to memory of 4708 732 6E98.tmp 86 PID 4708 wrote to memory of 3836 4708 6F44.tmp 87 PID 4708 wrote to memory of 3836 4708 6F44.tmp 87 PID 4708 wrote to memory of 3836 4708 6F44.tmp 87 PID 3836 wrote to memory of 4520 3836 6FD1.tmp 89 PID 3836 wrote to memory of 4520 3836 6FD1.tmp 89 PID 3836 wrote to memory of 4520 3836 6FD1.tmp 89 PID 4520 wrote to memory of 2636 4520 707D.tmp 90 PID 4520 wrote to memory of 2636 4520 707D.tmp 90 PID 4520 wrote to memory of 2636 4520 707D.tmp 90 PID 2636 wrote to memory of 3640 2636 7203.tmp 91 PID 2636 wrote to memory of 3640 2636 7203.tmp 91 PID 2636 wrote to memory of 3640 2636 7203.tmp 91 PID 3640 wrote to memory of 2424 3640 72DE.tmp 92 PID 3640 wrote to memory of 2424 3640 72DE.tmp 92 PID 3640 wrote to memory of 2424 3640 72DE.tmp 92 PID 2424 wrote to memory of 400 2424 73D8.tmp 93 PID 2424 wrote to memory of 400 2424 73D8.tmp 93 PID 2424 wrote to memory of 400 2424 73D8.tmp 93 PID 400 wrote to memory of 5048 400 74A3.tmp 94 PID 400 wrote to memory of 5048 400 74A3.tmp 94 PID 400 wrote to memory of 5048 400 74A3.tmp 94 PID 5048 wrote to memory of 5084 5048 757E.tmp 95 PID 5048 wrote to memory of 5084 5048 757E.tmp 95 PID 5048 wrote to memory of 5084 5048 757E.tmp 95 PID 5084 wrote to memory of 4688 5084 7688.tmp 96 PID 5084 wrote to memory of 4688 5084 7688.tmp 96 PID 5084 wrote to memory of 4688 5084 7688.tmp 96 PID 4688 wrote to memory of 2300 4688 7753.tmp 97 PID 4688 wrote to memory of 2300 4688 7753.tmp 97 PID 4688 wrote to memory of 2300 4688 7753.tmp 97 PID 2300 wrote to memory of 2592 2300 77FF.tmp 100 PID 2300 wrote to memory of 2592 2300 77FF.tmp 100 PID 2300 wrote to memory of 2592 2300 77FF.tmp 100 PID 2592 wrote to memory of 4464 2592 78E9.tmp 101 PID 2592 wrote to memory of 4464 2592 78E9.tmp 101 PID 2592 wrote to memory of 4464 2592 78E9.tmp 101 PID 4464 wrote to memory of 3736 4464 79B4.tmp 102 PID 4464 wrote to memory of 3736 4464 79B4.tmp 102 PID 4464 wrote to memory of 3736 4464 79B4.tmp 102 PID 3736 wrote to memory of 1392 3736 7A70.tmp 103 PID 3736 wrote to memory of 1392 3736 7A70.tmp 103 PID 3736 wrote to memory of 1392 3736 7A70.tmp 103 PID 1392 wrote to memory of 3616 1392 7BD7.tmp 104 PID 1392 wrote to memory of 3616 1392 7BD7.tmp 104 PID 1392 wrote to memory of 3616 1392 7BD7.tmp 104 PID 3616 wrote to memory of 1688 3616 7C64.tmp 105 PID 3616 wrote to memory of 1688 3616 7C64.tmp 105 PID 3616 wrote to memory of 1688 3616 7C64.tmp 105 PID 1688 wrote to memory of 2860 1688 7D00.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5e3cdb1c4a6274c6bf75b27f8cabb1e9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7688.tmp"C:\Users\Admin\AppData\Local\Temp\7688.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"23⤵
- Executes dropped EXE
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"24⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"25⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"26⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"27⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\80A9.tmp"C:\Users\Admin\AppData\Local\Temp\80A9.tmp"28⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"29⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"30⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"31⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"32⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"33⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"34⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8702.tmp"C:\Users\Admin\AppData\Local\Temp\8702.tmp"35⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"36⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"37⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"38⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"39⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"40⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"41⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"42⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"43⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"44⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"45⤵
- Executes dropped EXE
PID:688 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"46⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"47⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"48⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"49⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"50⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"51⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"52⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"53⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"54⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"55⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"56⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"57⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"58⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"59⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"60⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"61⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"62⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"63⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"64⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"65⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"66⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"67⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"68⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"69⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"70⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"71⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"72⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"73⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"74⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"75⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"76⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"77⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"78⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"79⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"80⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"81⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"82⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"83⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"84⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"85⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"86⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"87⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"88⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"89⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"90⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"91⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"92⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"93⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"94⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"95⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"96⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"97⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"98⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"99⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"100⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"101⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"102⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"103⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"104⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"105⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"106⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"107⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"108⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"109⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"110⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"111⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"112⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"113⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"114⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"115⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"116⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"117⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"118⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"119⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"120⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"121⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"122⤵PID:4668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-