Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe
-
Size
487KB
-
MD5
cc01d25d17b35192084cffa7dbbab4fa
-
SHA1
99e1ff9248547ca519c2972dc829cf3ae8ac7af1
-
SHA256
10f4c3ac70c841e46b11626e4172aa90185ba67b085a7203983d7590ac31d600
-
SHA512
4cd2733a273c4ef859fc37a7fb8175e90de6223bb43002bd6b83449879fc6ded8115ed43c5e4f65bac7409ba8990063308f86d3610de52ffd6943a12e5bcec31
-
SSDEEP
12288:yU5rCOTeiNdpse/YkdWPfO/ZSko1bvDc0GZobZ:yUQOJNwe/Ykdm8ZSkop0Cb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5048 7ED5.tmp 1184 7F90.tmp 4644 80B9.tmp 4628 81A3.tmp 2772 8240.tmp 3328 82FB.tmp 3032 8397.tmp 4904 8482.tmp 644 851E.tmp 1800 85AB.tmp 2736 878F.tmp 1136 884A.tmp 1916 8925.tmp 4528 8A10.tmp 2972 8ABB.tmp 3632 8B96.tmp 2032 8C32.tmp 4504 8D2C.tmp 2940 8DD8.tmp 5040 8E94.tmp 1384 8F40.tmp 3500 8FEC.tmp 2300 90B7.tmp 3288 9172.tmp 1808 921E.tmp 400 92DA.tmp 2580 9376.tmp 8 9422.tmp 3008 94BE.tmp 3292 956A.tmp 3296 9625.tmp 2376 96C2.tmp 3356 978D.tmp 2144 9829.tmp 4464 98A6.tmp 1128 9933.tmp 776 99BF.tmp 4220 9A6B.tmp 864 9B07.tmp 4836 9B94.tmp 4640 9C11.tmp 4588 9CAD.tmp 1560 9D3A.tmp 3432 9DC6.tmp 3164 9E63.tmp 3760 9F0F.tmp 2644 9FAB.tmp 2652 A047.tmp 4720 A170.tmp 2244 A1FD.tmp 4064 A289.tmp 4024 A316.tmp 3336 A3C2.tmp 3300 A45E.tmp 4820 A4DB.tmp 4100 A577.tmp 4360 A5F4.tmp 3704 A681.tmp 3772 A70D.tmp 1824 A7B9.tmp 4904 A856.tmp 644 A8C3.tmp 3428 A930.tmp 2252 A9AD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 5048 2812 cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe 82 PID 2812 wrote to memory of 5048 2812 cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe 82 PID 2812 wrote to memory of 5048 2812 cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe 82 PID 5048 wrote to memory of 1184 5048 7ED5.tmp 83 PID 5048 wrote to memory of 1184 5048 7ED5.tmp 83 PID 5048 wrote to memory of 1184 5048 7ED5.tmp 83 PID 1184 wrote to memory of 4644 1184 7F90.tmp 84 PID 1184 wrote to memory of 4644 1184 7F90.tmp 84 PID 1184 wrote to memory of 4644 1184 7F90.tmp 84 PID 4644 wrote to memory of 4628 4644 80B9.tmp 85 PID 4644 wrote to memory of 4628 4644 80B9.tmp 85 PID 4644 wrote to memory of 4628 4644 80B9.tmp 85 PID 4628 wrote to memory of 2772 4628 81A3.tmp 86 PID 4628 wrote to memory of 2772 4628 81A3.tmp 86 PID 4628 wrote to memory of 2772 4628 81A3.tmp 86 PID 2772 wrote to memory of 3328 2772 8240.tmp 87 PID 2772 wrote to memory of 3328 2772 8240.tmp 87 PID 2772 wrote to memory of 3328 2772 8240.tmp 87 PID 3328 wrote to memory of 3032 3328 82FB.tmp 88 PID 3328 wrote to memory of 3032 3328 82FB.tmp 88 PID 3328 wrote to memory of 3032 3328 82FB.tmp 88 PID 3032 wrote to memory of 4904 3032 8397.tmp 89 PID 3032 wrote to memory of 4904 3032 8397.tmp 89 PID 3032 wrote to memory of 4904 3032 8397.tmp 89 PID 4904 wrote to memory of 644 4904 8482.tmp 90 PID 4904 wrote to memory of 644 4904 8482.tmp 90 PID 4904 wrote to memory of 644 4904 8482.tmp 90 PID 644 wrote to memory of 1800 644 851E.tmp 91 PID 644 wrote to memory of 1800 644 851E.tmp 91 PID 644 wrote to memory of 1800 644 851E.tmp 91 PID 1800 wrote to memory of 2736 1800 85AB.tmp 92 PID 1800 wrote to memory of 2736 1800 85AB.tmp 92 PID 1800 wrote to memory of 2736 1800 85AB.tmp 92 PID 2736 wrote to memory of 1136 2736 878F.tmp 93 PID 2736 wrote to memory of 1136 2736 878F.tmp 93 PID 2736 wrote to memory of 1136 2736 878F.tmp 93 PID 1136 wrote to memory of 1916 1136 884A.tmp 94 PID 1136 wrote to memory of 1916 1136 884A.tmp 94 PID 1136 wrote to memory of 1916 1136 884A.tmp 94 PID 1916 wrote to memory of 4528 1916 8925.tmp 95 PID 1916 wrote to memory of 4528 1916 8925.tmp 95 PID 1916 wrote to memory of 4528 1916 8925.tmp 95 PID 4528 wrote to memory of 2972 4528 8A10.tmp 96 PID 4528 wrote to memory of 2972 4528 8A10.tmp 96 PID 4528 wrote to memory of 2972 4528 8A10.tmp 96 PID 2972 wrote to memory of 3632 2972 8ABB.tmp 97 PID 2972 wrote to memory of 3632 2972 8ABB.tmp 97 PID 2972 wrote to memory of 3632 2972 8ABB.tmp 97 PID 3632 wrote to memory of 2032 3632 8B96.tmp 100 PID 3632 wrote to memory of 2032 3632 8B96.tmp 100 PID 3632 wrote to memory of 2032 3632 8B96.tmp 100 PID 2032 wrote to memory of 4504 2032 8C32.tmp 101 PID 2032 wrote to memory of 4504 2032 8C32.tmp 101 PID 2032 wrote to memory of 4504 2032 8C32.tmp 101 PID 4504 wrote to memory of 2940 4504 8D2C.tmp 102 PID 4504 wrote to memory of 2940 4504 8D2C.tmp 102 PID 4504 wrote to memory of 2940 4504 8D2C.tmp 102 PID 2940 wrote to memory of 5040 2940 8DD8.tmp 103 PID 2940 wrote to memory of 5040 2940 8DD8.tmp 103 PID 2940 wrote to memory of 5040 2940 8DD8.tmp 103 PID 5040 wrote to memory of 1384 5040 8E94.tmp 104 PID 5040 wrote to memory of 1384 5040 8E94.tmp 104 PID 5040 wrote to memory of 1384 5040 8E94.tmp 104 PID 1384 wrote to memory of 3500 1384 8F40.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\cc01d25d17b35192084cffa7dbbab4fa_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"23⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\90B7.tmp"C:\Users\Admin\AppData\Local\Temp\90B7.tmp"24⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"25⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"26⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"27⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"28⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"29⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\94BE.tmp"C:\Users\Admin\AppData\Local\Temp\94BE.tmp"30⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"31⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"32⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"33⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"34⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"35⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"36⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"37⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"38⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"39⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"40⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"41⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"42⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"43⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"44⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"45⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"46⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"47⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"48⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"49⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"50⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"51⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"52⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"53⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"54⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"55⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"56⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"57⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"58⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"59⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"60⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"61⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"C:\Users\Admin\AppData\Local\Temp\A7B9.tmp"62⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"63⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"64⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"65⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"66⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"67⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"68⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"69⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"70⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"71⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"72⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"73⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"C:\Users\Admin\AppData\Local\Temp\ADB5.tmp"74⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"75⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"76⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"77⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"78⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"79⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"80⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"81⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"82⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"83⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"84⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"86⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"87⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"88⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"89⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"90⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"91⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"92⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"93⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"94⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"95⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"96⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"97⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"98⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"99⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"100⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"101⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"C:\Users\Admin\AppData\Local\Temp\BC7A.tmp"102⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"103⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"104⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"105⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"106⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"107⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"108⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"109⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"110⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"111⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"112⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"113⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"114⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"115⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"116⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"117⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"118⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"119⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"120⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"121⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-