Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe
-
Size
486KB
-
MD5
86dd9ae53242a13ba1084f4ab13f38ac
-
SHA1
5415c16d03def03602928c404f1067bdf0a45d28
-
SHA256
9b0595a2de7a57a90dcffddcdf7357e703731c19703e2016f303b450b3f6e3f0
-
SHA512
e165d82e638d700d862a1a684181dff1469ef441bd4466c40e11fec808b4745606d4777b36afafc86cb548f33687159cdbfad9612fd65ea2e6ad2d2cd96bdfcc
-
SSDEEP
12288:/U5rCOTeiDThVtO0FnLofqkMkWMipmQ2RgNZ:/UQOJDdD2qkhDuJQgN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3440 8388.tmp 1548 8443.tmp 4968 854D.tmp 4820 8647.tmp 4080 86F3.tmp 3096 879F.tmp 1272 885A.tmp 2472 8944.tmp 4404 8A2F.tmp 2128 8AEA.tmp 2664 8BD5.tmp 2840 8C90.tmp 3992 8D2C.tmp 60 8E07.tmp 2416 8EF2.tmp 2260 8FEC.tmp 1496 90C6.tmp 2436 9172.tmp 1716 921E.tmp 2344 92BA.tmp 3560 9366.tmp 2672 9858.tmp 2904 9952.tmp 4808 99FE.tmp 4128 9AAA.tmp 3044 9B94.tmp 2096 9C4F.tmp 1148 9CEC.tmp 2556 9DA7.tmp 2808 9E53.tmp 3052 9F0F.tmp 2204 9F8C.tmp 1868 A018.tmp 692 A0A5.tmp 4876 A131.tmp 3540 A1AE.tmp 1060 A25A.tmp 4440 A2D7.tmp 1764 A364.tmp 3812 A400.tmp 4148 A4AC.tmp 1380 A529.tmp 4756 A5C5.tmp 3024 A633.tmp 4008 A6A0.tmp 1296 A71D.tmp 4612 A79A.tmp 440 A7F8.tmp 3872 A865.tmp 4324 A8F2.tmp 4688 A950.tmp 1484 A9DC.tmp 4968 AA78.tmp 2572 AB05.tmp 4816 AB82.tmp 5064 AC2E.tmp 4956 ACCA.tmp 3544 AD47.tmp 2748 ADD4.tmp 4672 AE51.tmp 4196 AEDD.tmp 3340 AF7A.tmp 4248 AFE7.tmp 380 B064.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3376 wrote to memory of 3440 3376 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 82 PID 3376 wrote to memory of 3440 3376 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 82 PID 3376 wrote to memory of 3440 3376 86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe 82 PID 3440 wrote to memory of 1548 3440 8388.tmp 83 PID 3440 wrote to memory of 1548 3440 8388.tmp 83 PID 3440 wrote to memory of 1548 3440 8388.tmp 83 PID 1548 wrote to memory of 4968 1548 8443.tmp 84 PID 1548 wrote to memory of 4968 1548 8443.tmp 84 PID 1548 wrote to memory of 4968 1548 8443.tmp 84 PID 4968 wrote to memory of 4820 4968 854D.tmp 85 PID 4968 wrote to memory of 4820 4968 854D.tmp 85 PID 4968 wrote to memory of 4820 4968 854D.tmp 85 PID 4820 wrote to memory of 4080 4820 8647.tmp 86 PID 4820 wrote to memory of 4080 4820 8647.tmp 86 PID 4820 wrote to memory of 4080 4820 8647.tmp 86 PID 4080 wrote to memory of 3096 4080 86F3.tmp 87 PID 4080 wrote to memory of 3096 4080 86F3.tmp 87 PID 4080 wrote to memory of 3096 4080 86F3.tmp 87 PID 3096 wrote to memory of 1272 3096 879F.tmp 88 PID 3096 wrote to memory of 1272 3096 879F.tmp 88 PID 3096 wrote to memory of 1272 3096 879F.tmp 88 PID 1272 wrote to memory of 2472 1272 885A.tmp 89 PID 1272 wrote to memory of 2472 1272 885A.tmp 89 PID 1272 wrote to memory of 2472 1272 885A.tmp 89 PID 2472 wrote to memory of 4404 2472 8944.tmp 90 PID 2472 wrote to memory of 4404 2472 8944.tmp 90 PID 2472 wrote to memory of 4404 2472 8944.tmp 90 PID 4404 wrote to memory of 2128 4404 8A2F.tmp 91 PID 4404 wrote to memory of 2128 4404 8A2F.tmp 91 PID 4404 wrote to memory of 2128 4404 8A2F.tmp 91 PID 2128 wrote to memory of 2664 2128 8AEA.tmp 92 PID 2128 wrote to memory of 2664 2128 8AEA.tmp 92 PID 2128 wrote to memory of 2664 2128 8AEA.tmp 92 PID 2664 wrote to memory of 2840 2664 8BD5.tmp 93 PID 2664 wrote to memory of 2840 2664 8BD5.tmp 93 PID 2664 wrote to memory of 2840 2664 8BD5.tmp 93 PID 2840 wrote to memory of 3992 2840 8C90.tmp 94 PID 2840 wrote to memory of 3992 2840 8C90.tmp 94 PID 2840 wrote to memory of 3992 2840 8C90.tmp 94 PID 3992 wrote to memory of 60 3992 8D2C.tmp 95 PID 3992 wrote to memory of 60 3992 8D2C.tmp 95 PID 3992 wrote to memory of 60 3992 8D2C.tmp 95 PID 60 wrote to memory of 2416 60 8E07.tmp 96 PID 60 wrote to memory of 2416 60 8E07.tmp 96 PID 60 wrote to memory of 2416 60 8E07.tmp 96 PID 2416 wrote to memory of 2260 2416 8EF2.tmp 97 PID 2416 wrote to memory of 2260 2416 8EF2.tmp 97 PID 2416 wrote to memory of 2260 2416 8EF2.tmp 97 PID 2260 wrote to memory of 1496 2260 8FEC.tmp 98 PID 2260 wrote to memory of 1496 2260 8FEC.tmp 98 PID 2260 wrote to memory of 1496 2260 8FEC.tmp 98 PID 1496 wrote to memory of 2436 1496 90C6.tmp 99 PID 1496 wrote to memory of 2436 1496 90C6.tmp 99 PID 1496 wrote to memory of 2436 1496 90C6.tmp 99 PID 2436 wrote to memory of 1716 2436 9172.tmp 100 PID 2436 wrote to memory of 1716 2436 9172.tmp 100 PID 2436 wrote to memory of 1716 2436 9172.tmp 100 PID 1716 wrote to memory of 2344 1716 921E.tmp 101 PID 1716 wrote to memory of 2344 1716 921E.tmp 101 PID 1716 wrote to memory of 2344 1716 921E.tmp 101 PID 2344 wrote to memory of 3560 2344 92BA.tmp 102 PID 2344 wrote to memory of 3560 2344 92BA.tmp 102 PID 2344 wrote to memory of 3560 2344 92BA.tmp 102 PID 3560 wrote to memory of 2672 3560 9366.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\86dd9ae53242a13ba1084f4ab13f38ac_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"C:\Users\Admin\AppData\Local\Temp\8A2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"23⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"24⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"25⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"26⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"27⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"28⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"29⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"30⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"31⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"32⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"33⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"34⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"35⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"36⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"37⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"38⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"39⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"40⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"41⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"42⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"43⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"44⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"45⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"46⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\A71D.tmp"C:\Users\Admin\AppData\Local\Temp\A71D.tmp"47⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"48⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"49⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"50⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"51⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"52⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"53⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"54⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"55⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\AB82.tmp"C:\Users\Admin\AppData\Local\Temp\AB82.tmp"56⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"57⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"58⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"59⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"60⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"61⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"62⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"63⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"64⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"65⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"66⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"67⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"68⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"69⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"70⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"71⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"72⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"73⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"75⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"76⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"77⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"78⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"79⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"80⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"81⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"82⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"83⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"84⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"85⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"86⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"87⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"88⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"89⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"90⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"91⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"92⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"93⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"94⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"95⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"96⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"97⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"98⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"99⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"100⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"101⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"102⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"103⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\C60F.tmp"C:\Users\Admin\AppData\Local\Temp\C60F.tmp"104⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"105⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"106⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"C:\Users\Admin\AppData\Local\Temp\C7D4.tmp"107⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"108⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"109⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\C94B.tmp"C:\Users\Admin\AppData\Local\Temp\C94B.tmp"110⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"C:\Users\Admin\AppData\Local\Temp\C9D8.tmp"111⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"112⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"113⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"114⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"115⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"116⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"117⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"118⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"C:\Users\Admin\AppData\Local\Temp\CDDF.tmp"119⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"120⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"121⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"122⤵PID:4540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-