Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 16:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
bd695d83a819eec597016d1542f8f667_mafia_JC.exe
-
Size
486KB
-
MD5
bd695d83a819eec597016d1542f8f667
-
SHA1
6c026656b729d783e2bf68ebd8996d3390d0789c
-
SHA256
f7f251bcbf9185875b39e75a3d8ee4b26796d7e6e7ca1d018b0a0a2da0d71b11
-
SHA512
efe0eae722ede4e2ae3ba37d718f316696421732f2e59bcf2f611f02f31eb1d362283e7b4a2c47f142d92e3defb8f427f1710d34d7438e68e1264cfa52eedbda
-
SSDEEP
12288:/U5rCOTeiDdCALdbl3utR/EcHwzQlcNZ:/UQOJDdh3utRNH3cN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3824 77D0.tmp 2424 785C.tmp 2488 7908.tmp 4432 79F3.tmp 3808 7AAE.tmp 2460 7B4A.tmp 4568 7C15.tmp 1816 7D00.tmp 4548 7D7D.tmp 3820 7E86.tmp 3120 7F42.tmp 1640 7FAF.tmp 1600 802C.tmp 212 8136.tmp 2060 81C3.tmp 696 829D.tmp 4916 830B.tmp 2880 83A7.tmp 4676 8434.tmp 2876 84C0.tmp 4792 85CA.tmp 3776 8656.tmp 1804 86E3.tmp 764 878F.tmp 4480 87FC.tmp 5020 88D7.tmp 2228 89A2.tmp 4172 8A1F.tmp 4560 8ACB.tmp 4472 8B96.tmp 3228 8C81.tmp 1320 8CFE.tmp 4272 8DC9.tmp 4984 8E46.tmp 5008 8EB3.tmp 1608 8F5F.tmp 3132 8FFB.tmp 2472 9078.tmp 3444 90E6.tmp 2080 9182.tmp 1192 91FF.tmp 3964 928B.tmp 4420 9318.tmp 4328 93B4.tmp 2220 9451.tmp 4940 94CE.tmp 1760 954B.tmp 4376 95C8.tmp 3220 9654.tmp 4156 96D1.tmp 4444 975E.tmp 2488 97CB.tmp 1964 9858.tmp 1084 98F4.tmp 4448 9971.tmp 4456 9A0D.tmp 1628 9AAA.tmp 5016 9B46.tmp 4388 9BC3.tmp 1512 9C5F.tmp 4408 9CEC.tmp 1736 9D88.tmp 3120 9E05.tmp 412 9E82.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3824 4688 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 83 PID 4688 wrote to memory of 3824 4688 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 83 PID 4688 wrote to memory of 3824 4688 bd695d83a819eec597016d1542f8f667_mafia_JC.exe 83 PID 3824 wrote to memory of 2424 3824 77D0.tmp 84 PID 3824 wrote to memory of 2424 3824 77D0.tmp 84 PID 3824 wrote to memory of 2424 3824 77D0.tmp 84 PID 2424 wrote to memory of 2488 2424 785C.tmp 85 PID 2424 wrote to memory of 2488 2424 785C.tmp 85 PID 2424 wrote to memory of 2488 2424 785C.tmp 85 PID 2488 wrote to memory of 4432 2488 7908.tmp 86 PID 2488 wrote to memory of 4432 2488 7908.tmp 86 PID 2488 wrote to memory of 4432 2488 7908.tmp 86 PID 4432 wrote to memory of 3808 4432 79F3.tmp 87 PID 4432 wrote to memory of 3808 4432 79F3.tmp 87 PID 4432 wrote to memory of 3808 4432 79F3.tmp 87 PID 3808 wrote to memory of 2460 3808 7AAE.tmp 88 PID 3808 wrote to memory of 2460 3808 7AAE.tmp 88 PID 3808 wrote to memory of 2460 3808 7AAE.tmp 88 PID 2460 wrote to memory of 4568 2460 7B4A.tmp 89 PID 2460 wrote to memory of 4568 2460 7B4A.tmp 89 PID 2460 wrote to memory of 4568 2460 7B4A.tmp 89 PID 4568 wrote to memory of 1816 4568 7C15.tmp 90 PID 4568 wrote to memory of 1816 4568 7C15.tmp 90 PID 4568 wrote to memory of 1816 4568 7C15.tmp 90 PID 1816 wrote to memory of 4548 1816 7D00.tmp 91 PID 1816 wrote to memory of 4548 1816 7D00.tmp 91 PID 1816 wrote to memory of 4548 1816 7D00.tmp 91 PID 4548 wrote to memory of 3820 4548 7D7D.tmp 92 PID 4548 wrote to memory of 3820 4548 7D7D.tmp 92 PID 4548 wrote to memory of 3820 4548 7D7D.tmp 92 PID 3820 wrote to memory of 3120 3820 7E86.tmp 94 PID 3820 wrote to memory of 3120 3820 7E86.tmp 94 PID 3820 wrote to memory of 3120 3820 7E86.tmp 94 PID 3120 wrote to memory of 1640 3120 7F42.tmp 95 PID 3120 wrote to memory of 1640 3120 7F42.tmp 95 PID 3120 wrote to memory of 1640 3120 7F42.tmp 95 PID 1640 wrote to memory of 1600 1640 7FAF.tmp 96 PID 1640 wrote to memory of 1600 1640 7FAF.tmp 96 PID 1640 wrote to memory of 1600 1640 7FAF.tmp 96 PID 1600 wrote to memory of 212 1600 802C.tmp 97 PID 1600 wrote to memory of 212 1600 802C.tmp 97 PID 1600 wrote to memory of 212 1600 802C.tmp 97 PID 212 wrote to memory of 2060 212 8136.tmp 98 PID 212 wrote to memory of 2060 212 8136.tmp 98 PID 212 wrote to memory of 2060 212 8136.tmp 98 PID 2060 wrote to memory of 696 2060 81C3.tmp 99 PID 2060 wrote to memory of 696 2060 81C3.tmp 99 PID 2060 wrote to memory of 696 2060 81C3.tmp 99 PID 696 wrote to memory of 4916 696 829D.tmp 100 PID 696 wrote to memory of 4916 696 829D.tmp 100 PID 696 wrote to memory of 4916 696 829D.tmp 100 PID 4916 wrote to memory of 2880 4916 830B.tmp 101 PID 4916 wrote to memory of 2880 4916 830B.tmp 101 PID 4916 wrote to memory of 2880 4916 830B.tmp 101 PID 2880 wrote to memory of 4676 2880 83A7.tmp 102 PID 2880 wrote to memory of 4676 2880 83A7.tmp 102 PID 2880 wrote to memory of 4676 2880 83A7.tmp 102 PID 4676 wrote to memory of 2876 4676 8434.tmp 103 PID 4676 wrote to memory of 2876 4676 8434.tmp 103 PID 4676 wrote to memory of 2876 4676 8434.tmp 103 PID 2876 wrote to memory of 4792 2876 84C0.tmp 106 PID 2876 wrote to memory of 4792 2876 84C0.tmp 106 PID 2876 wrote to memory of 4792 2876 84C0.tmp 106 PID 4792 wrote to memory of 3776 4792 85CA.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd695d83a819eec597016d1542f8f667_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\bd695d83a819eec597016d1542f8f667_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"23⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"24⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"25⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"26⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"27⤵
- Executes dropped EXE
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"28⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"29⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"30⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"31⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"32⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"33⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"34⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"35⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"36⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"37⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"38⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"39⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"40⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"41⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"42⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"43⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"44⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"45⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"46⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"47⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"48⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"49⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"50⤵
- Executes dropped EXE
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"51⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"52⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"53⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"54⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"55⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"56⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"C:\Users\Admin\AppData\Local\Temp\9A0D.tmp"57⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"58⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"59⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"60⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"61⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"62⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"63⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"64⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"65⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"66⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"67⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"68⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"69⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"71⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"72⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"73⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"74⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"75⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"76⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"77⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"78⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"79⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"80⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"81⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"82⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"83⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\A894.tmp"C:\Users\Admin\AppData\Local\Temp\A894.tmp"84⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"85⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"86⤵PID:668
-
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"87⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"88⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"89⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"90⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"91⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"92⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"93⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"94⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"95⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"96⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"97⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"98⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"99⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"100⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"101⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"102⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"103⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"104⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"105⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"106⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"107⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"108⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"109⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"110⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"111⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"112⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"113⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"114⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"115⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"116⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"117⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"C:\Users\Admin\AppData\Local\Temp\B9BB.tmp"118⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"119⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"120⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"121⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-