Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 15:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe
-
Size
520KB
-
MD5
815706b5e6379ff606f05ceb7c47d898
-
SHA1
9867579e2613aa86f4ad7fdaf3c15f2597f3c320
-
SHA256
5516689719972f0498302ec8c8f73c2af90863bbaab0e549244d686ab8d0b892
-
SHA512
5fc1431c025ec69de0ad3cd109de7e5acc425df420effc9914944565adf59c65b86f03060da4790ccc529d11a8a4fc839aaa65f822e23abf61d9799c05169d49
-
SSDEEP
12288:roRXOQjmOyTtcJ+QWsL+vWA5u9E2CsmHJ1NZ:rogQ9yTt/rHWcsYN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2472 9395.tmp 4344 94BE.tmp 4188 9579.tmp 552 9645.tmp 5092 974E.tmp 3876 98C5.tmp 3456 9981.tmp 2060 9A2D.tmp 4768 9AD8.tmp 2296 9BB3.tmp 4256 9C5F.tmp 956 9CFB.tmp 2788 9E05.tmp 844 9EB1.tmp 2356 9F4D.tmp 2032 A057.tmp 496 A27A.tmp 2672 A335.tmp 3336 A3C2.tmp 3784 A47D.tmp 3612 A587.tmp 3128 A633.tmp 3856 A70D.tmp 3208 A7AA.tmp 2232 A846.tmp 1144 A8E2.tmp 1752 A950.tmp 1948 AA0B.tmp 2320 AAA7.tmp 2796 AB34.tmp 3504 ABE0.tmp 1572 AC9B.tmp 2500 AD28.tmp 4780 ADD4.tmp 3656 AE51.tmp 3904 AECE.tmp 3268 AF3B.tmp 4496 AFB8.tmp 1668 B016.tmp 4700 B0A3.tmp 2564 B120.tmp 752 B1AC.tmp 2692 B248.tmp 4528 B2C5.tmp 2532 B342.tmp 64 B3BF.tmp 4828 B44C.tmp 3232 B4E8.tmp 2440 B565.tmp 2740 B5F2.tmp 2208 B67F.tmp 3204 B70B.tmp 2056 B7B7.tmp 3044 B853.tmp 2620 B8C1.tmp 4016 B92E.tmp 4788 B9AB.tmp 3344 BA57.tmp 2408 BAE4.tmp 1500 BB70.tmp 2832 BBED.tmp 4956 BC99.tmp 4160 BD16.tmp 4832 BDA3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 2472 3924 815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe 83 PID 3924 wrote to memory of 2472 3924 815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe 83 PID 3924 wrote to memory of 2472 3924 815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe 83 PID 2472 wrote to memory of 4344 2472 9395.tmp 84 PID 2472 wrote to memory of 4344 2472 9395.tmp 84 PID 2472 wrote to memory of 4344 2472 9395.tmp 84 PID 4344 wrote to memory of 4188 4344 94BE.tmp 85 PID 4344 wrote to memory of 4188 4344 94BE.tmp 85 PID 4344 wrote to memory of 4188 4344 94BE.tmp 85 PID 4188 wrote to memory of 552 4188 9579.tmp 86 PID 4188 wrote to memory of 552 4188 9579.tmp 86 PID 4188 wrote to memory of 552 4188 9579.tmp 86 PID 552 wrote to memory of 5092 552 9645.tmp 87 PID 552 wrote to memory of 5092 552 9645.tmp 87 PID 552 wrote to memory of 5092 552 9645.tmp 87 PID 5092 wrote to memory of 3876 5092 974E.tmp 88 PID 5092 wrote to memory of 3876 5092 974E.tmp 88 PID 5092 wrote to memory of 3876 5092 974E.tmp 88 PID 3876 wrote to memory of 3456 3876 98C5.tmp 89 PID 3876 wrote to memory of 3456 3876 98C5.tmp 89 PID 3876 wrote to memory of 3456 3876 98C5.tmp 89 PID 3456 wrote to memory of 2060 3456 9981.tmp 90 PID 3456 wrote to memory of 2060 3456 9981.tmp 90 PID 3456 wrote to memory of 2060 3456 9981.tmp 90 PID 2060 wrote to memory of 4768 2060 9A2D.tmp 91 PID 2060 wrote to memory of 4768 2060 9A2D.tmp 91 PID 2060 wrote to memory of 4768 2060 9A2D.tmp 91 PID 4768 wrote to memory of 2296 4768 9AD8.tmp 92 PID 4768 wrote to memory of 2296 4768 9AD8.tmp 92 PID 4768 wrote to memory of 2296 4768 9AD8.tmp 92 PID 2296 wrote to memory of 4256 2296 9BB3.tmp 93 PID 2296 wrote to memory of 4256 2296 9BB3.tmp 93 PID 2296 wrote to memory of 4256 2296 9BB3.tmp 93 PID 4256 wrote to memory of 956 4256 9C5F.tmp 94 PID 4256 wrote to memory of 956 4256 9C5F.tmp 94 PID 4256 wrote to memory of 956 4256 9C5F.tmp 94 PID 956 wrote to memory of 2788 956 9CFB.tmp 95 PID 956 wrote to memory of 2788 956 9CFB.tmp 95 PID 956 wrote to memory of 2788 956 9CFB.tmp 95 PID 2788 wrote to memory of 844 2788 9E05.tmp 96 PID 2788 wrote to memory of 844 2788 9E05.tmp 96 PID 2788 wrote to memory of 844 2788 9E05.tmp 96 PID 844 wrote to memory of 2356 844 9EB1.tmp 97 PID 844 wrote to memory of 2356 844 9EB1.tmp 97 PID 844 wrote to memory of 2356 844 9EB1.tmp 97 PID 2356 wrote to memory of 2032 2356 9F4D.tmp 98 PID 2356 wrote to memory of 2032 2356 9F4D.tmp 98 PID 2356 wrote to memory of 2032 2356 9F4D.tmp 98 PID 2032 wrote to memory of 496 2032 A057.tmp 99 PID 2032 wrote to memory of 496 2032 A057.tmp 99 PID 2032 wrote to memory of 496 2032 A057.tmp 99 PID 496 wrote to memory of 2672 496 A27A.tmp 100 PID 496 wrote to memory of 2672 496 A27A.tmp 100 PID 496 wrote to memory of 2672 496 A27A.tmp 100 PID 2672 wrote to memory of 3336 2672 A335.tmp 101 PID 2672 wrote to memory of 3336 2672 A335.tmp 101 PID 2672 wrote to memory of 3336 2672 A335.tmp 101 PID 3336 wrote to memory of 3784 3336 A3C2.tmp 104 PID 3336 wrote to memory of 3784 3336 A3C2.tmp 104 PID 3336 wrote to memory of 3784 3336 A3C2.tmp 104 PID 3784 wrote to memory of 3612 3784 A47D.tmp 105 PID 3784 wrote to memory of 3612 3784 A47D.tmp 105 PID 3784 wrote to memory of 3612 3784 A47D.tmp 105 PID 3612 wrote to memory of 3128 3612 A587.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\815706b5e6379ff606f05ceb7c47d898_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"23⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"24⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"25⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"26⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"27⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"28⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"29⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"30⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"31⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"32⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"33⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"34⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"35⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"36⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"37⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"38⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"39⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"40⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"41⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"42⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"43⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"44⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"45⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"46⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"47⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"48⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"49⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"50⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"51⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"52⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"53⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"54⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"55⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"56⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"57⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"58⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"59⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"60⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"61⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"62⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"63⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"64⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"65⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"66⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"67⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"68⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"69⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"70⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"71⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"72⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"73⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"74⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"C:\Users\Admin\AppData\Local\Temp\C2F2.tmp"76⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"77⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"78⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"79⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\C534.tmp"C:\Users\Admin\AppData\Local\Temp\C534.tmp"80⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"81⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"82⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"83⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"84⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"85⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"86⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"87⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"88⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"89⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"90⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"91⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"92⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\CC68.tmp"C:\Users\Admin\AppData\Local\Temp\CC68.tmp"93⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"94⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"95⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"96⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"97⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"98⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"99⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"100⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"101⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"102⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"103⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"104⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"105⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"106⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"107⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"108⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"109⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\D467.tmp"C:\Users\Admin\AppData\Local\Temp\D467.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"111⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\D580.tmp"C:\Users\Admin\AppData\Local\Temp\D580.tmp"112⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"113⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"114⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"115⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"116⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"117⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"118⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"119⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"120⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"121⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-