Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe
-
Size
488KB
-
MD5
99d0b3dc9a6ce44ee30e99fb547e2f71
-
SHA1
23ed29aad8c10fb88df9ad47dccc7104f7c14c3a
-
SHA256
930cb1b4f0d2bc0f8cff64dfb7f8e0a408277523b2d816f8e5f7003a68678e58
-
SHA512
b7176827582a2125d66a6ed5330421d43e72ec4691ec0bd7f2b27668c473382a85857b34c4d85bf4de78fa532cc982a131d3aa96c742b89604080e1372070a0c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7JScwm0W8eshXoT9j/C5bGOtzqyPh+3nqnsHT:/U5rCOTeiDJSNm0boT92bGuz3o3XNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3664 761A.tmp 1224 7714.tmp 1656 77C0.tmp 4244 78BA.tmp 3340 79D3.tmp 1308 7B3B.tmp 5112 7BC7.tmp 2944 7CA2.tmp 2604 7D5E.tmp 1100 7E29.tmp 2300 7EE4.tmp 4064 7FDE.tmp 3572 80B9.tmp 2336 81A3.tmp 4352 824F.tmp 232 832A.tmp 3800 8424.tmp 5092 850E.tmp 5080 85BA.tmp 1684 8666.tmp 2960 8770.tmp 3988 881C.tmp 2348 88C7.tmp 4636 8973.tmp 4212 8A10.tmp 2256 8ACB.tmp 2008 8B77.tmp 1464 8C42.tmp 3776 8D1D.tmp 1736 8DC9.tmp 4456 8E75.tmp 2260 8F20.tmp 4932 8FFB.tmp 2264 9097.tmp 3080 9124.tmp 5096 91B1.tmp 4684 921E.tmp 1836 92DA.tmp 4976 9385.tmp 2252 9422.tmp 1340 94CE.tmp 1348 95B8.tmp 64 9645.tmp 3268 96B2.tmp 2872 974E.tmp 1712 97FA.tmp 1920 98A6.tmp 2020 9933.tmp 4828 99CF.tmp 3408 9AC9.tmp 3388 9B46.tmp 4332 9BC3.tmp 3664 9C30.tmp 2876 9CEC.tmp 60 9D78.tmp 780 9E05.tmp 1160 9E92.tmp 4196 9F1E.tmp 456 9FAB.tmp 4560 A037.tmp 3640 A0B4.tmp 3960 A160.tmp 4692 A1DD.tmp 4596 A25A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 3664 4816 99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe 83 PID 4816 wrote to memory of 3664 4816 99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe 83 PID 4816 wrote to memory of 3664 4816 99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe 83 PID 3664 wrote to memory of 1224 3664 761A.tmp 84 PID 3664 wrote to memory of 1224 3664 761A.tmp 84 PID 3664 wrote to memory of 1224 3664 761A.tmp 84 PID 1224 wrote to memory of 1656 1224 7714.tmp 85 PID 1224 wrote to memory of 1656 1224 7714.tmp 85 PID 1224 wrote to memory of 1656 1224 7714.tmp 85 PID 1656 wrote to memory of 4244 1656 77C0.tmp 86 PID 1656 wrote to memory of 4244 1656 77C0.tmp 86 PID 1656 wrote to memory of 4244 1656 77C0.tmp 86 PID 4244 wrote to memory of 3340 4244 78BA.tmp 87 PID 4244 wrote to memory of 3340 4244 78BA.tmp 87 PID 4244 wrote to memory of 3340 4244 78BA.tmp 87 PID 3340 wrote to memory of 1308 3340 79D3.tmp 88 PID 3340 wrote to memory of 1308 3340 79D3.tmp 88 PID 3340 wrote to memory of 1308 3340 79D3.tmp 88 PID 1308 wrote to memory of 5112 1308 7B3B.tmp 89 PID 1308 wrote to memory of 5112 1308 7B3B.tmp 89 PID 1308 wrote to memory of 5112 1308 7B3B.tmp 89 PID 5112 wrote to memory of 2944 5112 7BC7.tmp 90 PID 5112 wrote to memory of 2944 5112 7BC7.tmp 90 PID 5112 wrote to memory of 2944 5112 7BC7.tmp 90 PID 2944 wrote to memory of 2604 2944 7CA2.tmp 91 PID 2944 wrote to memory of 2604 2944 7CA2.tmp 91 PID 2944 wrote to memory of 2604 2944 7CA2.tmp 91 PID 2604 wrote to memory of 1100 2604 7D5E.tmp 92 PID 2604 wrote to memory of 1100 2604 7D5E.tmp 92 PID 2604 wrote to memory of 1100 2604 7D5E.tmp 92 PID 1100 wrote to memory of 2300 1100 7E29.tmp 93 PID 1100 wrote to memory of 2300 1100 7E29.tmp 93 PID 1100 wrote to memory of 2300 1100 7E29.tmp 93 PID 2300 wrote to memory of 4064 2300 7EE4.tmp 94 PID 2300 wrote to memory of 4064 2300 7EE4.tmp 94 PID 2300 wrote to memory of 4064 2300 7EE4.tmp 94 PID 4064 wrote to memory of 3572 4064 7FDE.tmp 95 PID 4064 wrote to memory of 3572 4064 7FDE.tmp 95 PID 4064 wrote to memory of 3572 4064 7FDE.tmp 95 PID 3572 wrote to memory of 2336 3572 80B9.tmp 96 PID 3572 wrote to memory of 2336 3572 80B9.tmp 96 PID 3572 wrote to memory of 2336 3572 80B9.tmp 96 PID 2336 wrote to memory of 4352 2336 81A3.tmp 97 PID 2336 wrote to memory of 4352 2336 81A3.tmp 97 PID 2336 wrote to memory of 4352 2336 81A3.tmp 97 PID 4352 wrote to memory of 232 4352 824F.tmp 98 PID 4352 wrote to memory of 232 4352 824F.tmp 98 PID 4352 wrote to memory of 232 4352 824F.tmp 98 PID 232 wrote to memory of 3800 232 832A.tmp 99 PID 232 wrote to memory of 3800 232 832A.tmp 99 PID 232 wrote to memory of 3800 232 832A.tmp 99 PID 3800 wrote to memory of 5092 3800 8424.tmp 100 PID 3800 wrote to memory of 5092 3800 8424.tmp 100 PID 3800 wrote to memory of 5092 3800 8424.tmp 100 PID 5092 wrote to memory of 5080 5092 850E.tmp 103 PID 5092 wrote to memory of 5080 5092 850E.tmp 103 PID 5092 wrote to memory of 5080 5092 850E.tmp 103 PID 5080 wrote to memory of 1684 5080 85BA.tmp 104 PID 5080 wrote to memory of 1684 5080 85BA.tmp 104 PID 5080 wrote to memory of 1684 5080 85BA.tmp 104 PID 1684 wrote to memory of 2960 1684 8666.tmp 105 PID 1684 wrote to memory of 2960 1684 8666.tmp 105 PID 1684 wrote to memory of 2960 1684 8666.tmp 105 PID 2960 wrote to memory of 3988 2960 8770.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\99d0b3dc9a6ce44ee30e99fb547e2f71_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8666.tmp"C:\Users\Admin\AppData\Local\Temp\8666.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"23⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"24⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"25⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"26⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"27⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"28⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"29⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"C:\Users\Admin\AppData\Local\Temp\8D1D.tmp"30⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"31⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"32⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"33⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"34⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"35⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"36⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"37⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"38⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"39⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"40⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"41⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"42⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"43⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"44⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"45⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"46⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"47⤵
- Executes dropped EXE
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"48⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"49⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"50⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"51⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"52⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"53⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"54⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"55⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"56⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"57⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"58⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"59⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"60⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"61⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"62⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"63⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"64⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"65⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"66⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"67⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"68⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"69⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"70⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"71⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"72⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"73⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"74⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\A73C.tmp"C:\Users\Admin\AppData\Local\Temp\A73C.tmp"75⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"76⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"77⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"78⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"79⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"80⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"81⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"82⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"83⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"84⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"85⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"86⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\AE32.tmp"C:\Users\Admin\AppData\Local\Temp\AE32.tmp"87⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"88⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"89⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"90⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"91⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"92⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"93⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"94⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"95⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"96⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"97⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"98⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"99⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"100⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"101⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"102⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"103⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"104⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"105⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"106⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"107⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"108⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"109⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"110⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"111⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"113⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"114⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"115⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"116⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"117⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"118⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"119⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"120⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"121⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"122⤵PID:3708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-