Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe
-
Size
486KB
-
MD5
c53c2393b06230608ac6bb6ef7d18304
-
SHA1
fae1499f94a4ed27001f11d65ffc46a4aba02ab9
-
SHA256
fba6bf768dc5fd08da04179541d87c2c64f593bb0146e9169490c0d758188a77
-
SHA512
2525cac206e8bccbfe7480305d63906bb8aa3d20c6659b6c662488edf865b9ee40026a2a551156b5d0e150d75d31c55562dbe11b43a9fa582303856eca4d0e09
-
SSDEEP
12288:/U5rCOTeiD+rMlCnr4UrWTsSV/hwVfLtNZ:/UQOJD+A0r6sA/qdLtN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4164 6CE3.tmp 4240 6DBE.tmp 4732 6E79.tmp 4040 6F35.tmp 4068 701F.tmp 2960 7109.tmp 4192 71B5.tmp 2664 7271.tmp 3564 72FD.tmp 2596 738A.tmp 1340 7445.tmp 2508 74F1.tmp 4444 75BC.tmp 2504 7659.tmp 2552 7705.tmp 1388 77A1.tmp 3160 785C.tmp 3136 7918.tmp 2008 7A12.tmp 2676 7ABE.tmp 1084 7BA8.tmp 3052 7C25.tmp 4056 7D2F.tmp 3048 7E19.tmp 3308 7EA6.tmp 4336 7F90.tmp 2848 805B.tmp 3320 8136.tmp 4156 8201.tmp 3964 82DC.tmp 2264 8397.tmp 4100 8491.tmp 4848 853D.tmp 1892 85CA.tmp 3928 8637.tmp 4400 86C4.tmp 4228 8760.tmp 4136 87FC.tmp 2672 8889.tmp 844 8925.tmp 3676 89D1.tmp 2232 8A4E.tmp 4388 8ADB.tmp 4256 8B77.tmp 5076 8C04.tmp 3120 8CA0.tmp 4176 8D2C.tmp 1956 8DC9.tmp 3256 8EE2.tmp 4320 8F7E.tmp 4992 8FFB.tmp 5012 9088.tmp 1368 9124.tmp 4492 91C0.tmp 2732 924D.tmp 4240 92DA.tmp 4664 9376.tmp 3800 9402.tmp 1828 949F.tmp 1528 952B.tmp 3768 95A8.tmp 4668 9635.tmp 3756 96B2.tmp 4892 971F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4164 5004 c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe 81 PID 5004 wrote to memory of 4164 5004 c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe 81 PID 5004 wrote to memory of 4164 5004 c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe 81 PID 4164 wrote to memory of 4240 4164 6CE3.tmp 82 PID 4164 wrote to memory of 4240 4164 6CE3.tmp 82 PID 4164 wrote to memory of 4240 4164 6CE3.tmp 82 PID 4240 wrote to memory of 4732 4240 6DBE.tmp 83 PID 4240 wrote to memory of 4732 4240 6DBE.tmp 83 PID 4240 wrote to memory of 4732 4240 6DBE.tmp 83 PID 4732 wrote to memory of 4040 4732 6E79.tmp 84 PID 4732 wrote to memory of 4040 4732 6E79.tmp 84 PID 4732 wrote to memory of 4040 4732 6E79.tmp 84 PID 4040 wrote to memory of 4068 4040 6F35.tmp 85 PID 4040 wrote to memory of 4068 4040 6F35.tmp 85 PID 4040 wrote to memory of 4068 4040 6F35.tmp 85 PID 4068 wrote to memory of 2960 4068 701F.tmp 86 PID 4068 wrote to memory of 2960 4068 701F.tmp 86 PID 4068 wrote to memory of 2960 4068 701F.tmp 86 PID 2960 wrote to memory of 4192 2960 7109.tmp 87 PID 2960 wrote to memory of 4192 2960 7109.tmp 87 PID 2960 wrote to memory of 4192 2960 7109.tmp 87 PID 4192 wrote to memory of 2664 4192 71B5.tmp 88 PID 4192 wrote to memory of 2664 4192 71B5.tmp 88 PID 4192 wrote to memory of 2664 4192 71B5.tmp 88 PID 2664 wrote to memory of 3564 2664 7271.tmp 89 PID 2664 wrote to memory of 3564 2664 7271.tmp 89 PID 2664 wrote to memory of 3564 2664 7271.tmp 89 PID 3564 wrote to memory of 2596 3564 72FD.tmp 91 PID 3564 wrote to memory of 2596 3564 72FD.tmp 91 PID 3564 wrote to memory of 2596 3564 72FD.tmp 91 PID 2596 wrote to memory of 1340 2596 738A.tmp 92 PID 2596 wrote to memory of 1340 2596 738A.tmp 92 PID 2596 wrote to memory of 1340 2596 738A.tmp 92 PID 1340 wrote to memory of 2508 1340 7445.tmp 93 PID 1340 wrote to memory of 2508 1340 7445.tmp 93 PID 1340 wrote to memory of 2508 1340 7445.tmp 93 PID 2508 wrote to memory of 4444 2508 74F1.tmp 94 PID 2508 wrote to memory of 4444 2508 74F1.tmp 94 PID 2508 wrote to memory of 4444 2508 74F1.tmp 94 PID 4444 wrote to memory of 2504 4444 75BC.tmp 95 PID 4444 wrote to memory of 2504 4444 75BC.tmp 95 PID 4444 wrote to memory of 2504 4444 75BC.tmp 95 PID 2504 wrote to memory of 2552 2504 7659.tmp 96 PID 2504 wrote to memory of 2552 2504 7659.tmp 96 PID 2504 wrote to memory of 2552 2504 7659.tmp 96 PID 2552 wrote to memory of 1388 2552 7705.tmp 97 PID 2552 wrote to memory of 1388 2552 7705.tmp 97 PID 2552 wrote to memory of 1388 2552 7705.tmp 97 PID 1388 wrote to memory of 3160 1388 77A1.tmp 98 PID 1388 wrote to memory of 3160 1388 77A1.tmp 98 PID 1388 wrote to memory of 3160 1388 77A1.tmp 98 PID 3160 wrote to memory of 3136 3160 785C.tmp 99 PID 3160 wrote to memory of 3136 3160 785C.tmp 99 PID 3160 wrote to memory of 3136 3160 785C.tmp 99 PID 3136 wrote to memory of 2008 3136 7918.tmp 100 PID 3136 wrote to memory of 2008 3136 7918.tmp 100 PID 3136 wrote to memory of 2008 3136 7918.tmp 100 PID 2008 wrote to memory of 2676 2008 7A12.tmp 103 PID 2008 wrote to memory of 2676 2008 7A12.tmp 103 PID 2008 wrote to memory of 2676 2008 7A12.tmp 103 PID 2676 wrote to memory of 1084 2676 7ABE.tmp 104 PID 2676 wrote to memory of 1084 2676 7ABE.tmp 104 PID 2676 wrote to memory of 1084 2676 7ABE.tmp 104 PID 1084 wrote to memory of 3052 1084 7BA8.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\c53c2393b06230608ac6bb6ef7d18304_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\7A12.tmp"C:\Users\Admin\AppData\Local\Temp\7A12.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"23⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"24⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"25⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"26⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"27⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"28⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"29⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"30⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"31⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"32⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\8491.tmp"C:\Users\Admin\AppData\Local\Temp\8491.tmp"33⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"34⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\85CA.tmp"C:\Users\Admin\AppData\Local\Temp\85CA.tmp"35⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"36⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\86C4.tmp"C:\Users\Admin\AppData\Local\Temp\86C4.tmp"37⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"38⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\87FC.tmp"C:\Users\Admin\AppData\Local\Temp\87FC.tmp"39⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"40⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"41⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"42⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"43⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"44⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"45⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"46⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"47⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"48⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"49⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"50⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"51⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"52⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"C:\Users\Admin\AppData\Local\Temp\8FFB.tmp"53⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"54⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"55⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"56⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"57⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"58⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"59⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"60⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"61⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"62⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"63⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"64⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"65⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"66⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"67⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"68⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"69⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"70⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"71⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"72⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"73⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"74⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"75⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"76⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"77⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"78⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"79⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"80⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"81⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"82⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"83⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"84⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"85⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"86⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"88⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"89⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"90⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"91⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"92⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"93⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"94⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"95⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"96⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"97⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"98⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"99⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"100⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"101⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"102⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"103⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"104⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"105⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"106⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"107⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"108⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"109⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"110⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"111⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"112⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"C:\Users\Admin\AppData\Local\Temp\AFB8.tmp"113⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"114⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"115⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"116⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"117⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"118⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"119⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"121⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"122⤵PID:4712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-