Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbc8514d095864aca53495add09083f0_mafia_JC.exe
Resource
win7-20230824-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bbc8514d095864aca53495add09083f0_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bbc8514d095864aca53495add09083f0_mafia_JC.exe
-
Size
487KB
-
MD5
bbc8514d095864aca53495add09083f0
-
SHA1
a74aaaa8dcecc3c60e2b9e353ca91871103f792b
-
SHA256
088e30af995b3eb88275b25ce3f6cf40a17dadd9fefc4349b7c2f1e5b907344d
-
SHA512
9a8c11371618930fee87ca9318b7ce2e48f12999809ad700c6c3f3374df84ee2004b978ed7bad9cb39aa834cc71dcfe7ebaaa181a25e9db15f2af05302c2a88e
-
SSDEEP
12288:yU5rCOTeiNwmZDCt1qy6Kp6sk26TP6jVujGwPbZ:yUQOJNdXmkQIjGUb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1312 79A4.tmp 4988 7A9E.tmp 1280 7B2B.tmp 3592 7C06.tmp 1232 7CA2.tmp 4080 7D4E.tmp 920 7DFA.tmp 4744 7EC5.tmp 4628 7FA0.tmp 1904 808A.tmp 2144 854D.tmp 4056 85F9.tmp 1188 86B4.tmp 1424 8741.tmp 1384 87FC.tmp 328 88B8.tmp 4116 8944.tmp 3480 8A10.tmp 4644 8B29.tmp 3696 8BC5.tmp 4268 8C61.tmp 1164 8CFE.tmp 4340 8D7B.tmp 3020 8E17.tmp 1980 8EA3.tmp 2744 8F30.tmp 4604 8FDC.tmp 2168 9097.tmp 1932 91A1.tmp 3484 924D.tmp 3596 92DA.tmp 1456 9376.tmp 2928 9422.tmp 3272 94AE.tmp 1984 954B.tmp 4876 95E7.tmp 1468 9683.tmp 3328 971F.tmp 2812 979C.tmp 4732 9829.tmp 4648 98A6.tmp 3904 9933.tmp 4060 9A5B.tmp 5048 9AF8.tmp 404 9B65.tmp 1472 9BF2.tmp 4924 9CEC.tmp 4052 9D78.tmp 3112 9DE6.tmp 2456 9E82.tmp 4988 9F0F.tmp 3860 9F8C.tmp 2796 A028.tmp 3900 A0B4.tmp 1232 A141.tmp 380 A1DD.tmp 1124 A25A.tmp 2372 A2D7.tmp 4768 A383.tmp 4292 A42F.tmp 3756 A49C.tmp 1200 A50A.tmp 4136 A568.tmp 1424 A604.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 1312 4052 bbc8514d095864aca53495add09083f0_mafia_JC.exe 82 PID 4052 wrote to memory of 1312 4052 bbc8514d095864aca53495add09083f0_mafia_JC.exe 82 PID 4052 wrote to memory of 1312 4052 bbc8514d095864aca53495add09083f0_mafia_JC.exe 82 PID 1312 wrote to memory of 4988 1312 79A4.tmp 83 PID 1312 wrote to memory of 4988 1312 79A4.tmp 83 PID 1312 wrote to memory of 4988 1312 79A4.tmp 83 PID 4988 wrote to memory of 1280 4988 7A9E.tmp 84 PID 4988 wrote to memory of 1280 4988 7A9E.tmp 84 PID 4988 wrote to memory of 1280 4988 7A9E.tmp 84 PID 1280 wrote to memory of 3592 1280 7B2B.tmp 85 PID 1280 wrote to memory of 3592 1280 7B2B.tmp 85 PID 1280 wrote to memory of 3592 1280 7B2B.tmp 85 PID 3592 wrote to memory of 1232 3592 7C06.tmp 86 PID 3592 wrote to memory of 1232 3592 7C06.tmp 86 PID 3592 wrote to memory of 1232 3592 7C06.tmp 86 PID 1232 wrote to memory of 4080 1232 7CA2.tmp 87 PID 1232 wrote to memory of 4080 1232 7CA2.tmp 87 PID 1232 wrote to memory of 4080 1232 7CA2.tmp 87 PID 4080 wrote to memory of 920 4080 7D4E.tmp 88 PID 4080 wrote to memory of 920 4080 7D4E.tmp 88 PID 4080 wrote to memory of 920 4080 7D4E.tmp 88 PID 920 wrote to memory of 4744 920 7DFA.tmp 89 PID 920 wrote to memory of 4744 920 7DFA.tmp 89 PID 920 wrote to memory of 4744 920 7DFA.tmp 89 PID 4744 wrote to memory of 4628 4744 7EC5.tmp 90 PID 4744 wrote to memory of 4628 4744 7EC5.tmp 90 PID 4744 wrote to memory of 4628 4744 7EC5.tmp 90 PID 4628 wrote to memory of 1904 4628 7FA0.tmp 91 PID 4628 wrote to memory of 1904 4628 7FA0.tmp 91 PID 4628 wrote to memory of 1904 4628 7FA0.tmp 91 PID 1904 wrote to memory of 2144 1904 808A.tmp 92 PID 1904 wrote to memory of 2144 1904 808A.tmp 92 PID 1904 wrote to memory of 2144 1904 808A.tmp 92 PID 2144 wrote to memory of 4056 2144 854D.tmp 93 PID 2144 wrote to memory of 4056 2144 854D.tmp 93 PID 2144 wrote to memory of 4056 2144 854D.tmp 93 PID 4056 wrote to memory of 1188 4056 85F9.tmp 94 PID 4056 wrote to memory of 1188 4056 85F9.tmp 94 PID 4056 wrote to memory of 1188 4056 85F9.tmp 94 PID 1188 wrote to memory of 1424 1188 86B4.tmp 97 PID 1188 wrote to memory of 1424 1188 86B4.tmp 97 PID 1188 wrote to memory of 1424 1188 86B4.tmp 97 PID 1424 wrote to memory of 1384 1424 8741.tmp 98 PID 1424 wrote to memory of 1384 1424 8741.tmp 98 PID 1424 wrote to memory of 1384 1424 8741.tmp 98 PID 1384 wrote to memory of 328 1384 87FC.tmp 99 PID 1384 wrote to memory of 328 1384 87FC.tmp 99 PID 1384 wrote to memory of 328 1384 87FC.tmp 99 PID 328 wrote to memory of 4116 328 88B8.tmp 100 PID 328 wrote to memory of 4116 328 88B8.tmp 100 PID 328 wrote to memory of 4116 328 88B8.tmp 100 PID 4116 wrote to memory of 3480 4116 8944.tmp 101 PID 4116 wrote to memory of 3480 4116 8944.tmp 101 PID 4116 wrote to memory of 3480 4116 8944.tmp 101 PID 3480 wrote to memory of 4644 3480 8A10.tmp 102 PID 3480 wrote to memory of 4644 3480 8A10.tmp 102 PID 3480 wrote to memory of 4644 3480 8A10.tmp 102 PID 4644 wrote to memory of 3696 4644 8B29.tmp 104 PID 4644 wrote to memory of 3696 4644 8B29.tmp 104 PID 4644 wrote to memory of 3696 4644 8B29.tmp 104 PID 3696 wrote to memory of 4268 3696 8BC5.tmp 105 PID 3696 wrote to memory of 4268 3696 8BC5.tmp 105 PID 3696 wrote to memory of 4268 3696 8BC5.tmp 105 PID 4268 wrote to memory of 1164 4268 8C61.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc8514d095864aca53495add09083f0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bbc8514d095864aca53495add09083f0_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\Temp\8944.tmp"C:\Users\Admin\AppData\Local\Temp\8944.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"23⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"24⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"25⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"26⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"27⤵
- Executes dropped EXE
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"28⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"29⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"30⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"31⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"32⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"33⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"34⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"35⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"36⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"37⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"38⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"39⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"40⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"41⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"42⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"43⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"44⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"45⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"46⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"47⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"48⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"49⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"50⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"51⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"52⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"53⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"55⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"56⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"57⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"58⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"59⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"60⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"61⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"62⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"63⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"64⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"65⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"66⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"67⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"68⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"69⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"70⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"71⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"72⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"73⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"74⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"75⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"76⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"77⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"78⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"79⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"80⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\AD57.tmp"C:\Users\Admin\AppData\Local\Temp\AD57.tmp"81⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"82⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"83⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"84⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"85⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"86⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"87⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"88⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"89⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"90⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"91⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"92⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"93⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"94⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"95⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"96⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"97⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"98⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"99⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"100⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"101⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"102⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"103⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"104⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"105⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"106⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"107⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"108⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"109⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"110⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"111⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"112⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"113⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"114⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"115⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"116⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"117⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"118⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"119⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"120⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"121⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"122⤵PID:4048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-