Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
30/08/2023, 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe
-
Size
520KB
-
MD5
de75b243731b3384b97fca46e8b0a0e9
-
SHA1
9713dc42077ccf4168c0c30749b0b6ade1971c04
-
SHA256
d6662112e7780d68115a4348f4b35cf983a625c96d00d5cb8a22ddc95228719f
-
SHA512
c701a3e9f0d696bd9168e0bec8123817c6fece1d1276ad98350be0cb01afd9f1ddfa7d0dcde53e1fe0004ab491cc92416c90a3084014cdad3262b817ac76440c
-
SSDEEP
12288:roRXOQjmOydXKsoHNMyj07RbidlFh5zJIXNZ:rogQ9ygs7ywiHFPJ2N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 877F.tmp 3656 882B.tmp 4620 88D7.tmp 3044 89B2.tmp 1776 8A7D.tmp 4792 8B29.tmp 2284 8BC5.tmp 4132 8C52.tmp 4960 8CEE.tmp 3544 8D8A.tmp 2560 8DE8.tmp 2000 8EF2.tmp 1592 8FCC.tmp 2584 9069.tmp 3592 9105.tmp 1648 91C0.tmp 1116 924D.tmp 4860 92E9.tmp 924 9395.tmp 5088 9422.tmp 4576 949F.tmp 3804 9599.tmp 2920 9664.tmp 4200 9700.tmp 1664 97BC.tmp 756 9839.tmp 4512 98A6.tmp 2360 9952.tmp 4272 9A1D.tmp 2392 9AF8.tmp 3384 9BA4.tmp 4092 9C6F.tmp 2752 9D0B.tmp 2684 9D78.tmp 1876 9E05.tmp 1064 9E92.tmp 2168 9F1E.tmp 4788 9FAB.tmp 2780 A037.tmp 216 A0D4.tmp 2104 A160.tmp 2668 A20C.tmp 3684 A2B8.tmp 3800 A3C2.tmp 4148 A44E.tmp 4140 A4EB.tmp 1236 A5A6.tmp 4304 A613.tmp 836 A6A0.tmp 4620 A72D.tmp 1528 A79A.tmp 2280 A817.tmp 5084 A8A4.tmp 2308 A930.tmp 3724 A9CD.tmp 1180 AA3A.tmp 4372 AAB7.tmp 1504 AB44.tmp 1572 ABEF.tmp 1620 AC6C.tmp 3624 ACF9.tmp 4740 AD95.tmp 2560 AE22.tmp 2296 AEAF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3888 wrote to memory of 2388 3888 de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe 82 PID 3888 wrote to memory of 2388 3888 de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe 82 PID 3888 wrote to memory of 2388 3888 de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe 82 PID 2388 wrote to memory of 3656 2388 877F.tmp 83 PID 2388 wrote to memory of 3656 2388 877F.tmp 83 PID 2388 wrote to memory of 3656 2388 877F.tmp 83 PID 3656 wrote to memory of 4620 3656 882B.tmp 84 PID 3656 wrote to memory of 4620 3656 882B.tmp 84 PID 3656 wrote to memory of 4620 3656 882B.tmp 84 PID 4620 wrote to memory of 3044 4620 88D7.tmp 85 PID 4620 wrote to memory of 3044 4620 88D7.tmp 85 PID 4620 wrote to memory of 3044 4620 88D7.tmp 85 PID 3044 wrote to memory of 1776 3044 89B2.tmp 86 PID 3044 wrote to memory of 1776 3044 89B2.tmp 86 PID 3044 wrote to memory of 1776 3044 89B2.tmp 86 PID 1776 wrote to memory of 4792 1776 8A7D.tmp 87 PID 1776 wrote to memory of 4792 1776 8A7D.tmp 87 PID 1776 wrote to memory of 4792 1776 8A7D.tmp 87 PID 4792 wrote to memory of 2284 4792 8B29.tmp 88 PID 4792 wrote to memory of 2284 4792 8B29.tmp 88 PID 4792 wrote to memory of 2284 4792 8B29.tmp 88 PID 2284 wrote to memory of 4132 2284 8BC5.tmp 89 PID 2284 wrote to memory of 4132 2284 8BC5.tmp 89 PID 2284 wrote to memory of 4132 2284 8BC5.tmp 89 PID 4132 wrote to memory of 4960 4132 8C52.tmp 90 PID 4132 wrote to memory of 4960 4132 8C52.tmp 90 PID 4132 wrote to memory of 4960 4132 8C52.tmp 90 PID 4960 wrote to memory of 3544 4960 8CEE.tmp 91 PID 4960 wrote to memory of 3544 4960 8CEE.tmp 91 PID 4960 wrote to memory of 3544 4960 8CEE.tmp 91 PID 3544 wrote to memory of 2560 3544 8D8A.tmp 92 PID 3544 wrote to memory of 2560 3544 8D8A.tmp 92 PID 3544 wrote to memory of 2560 3544 8D8A.tmp 92 PID 2560 wrote to memory of 2000 2560 8DE8.tmp 93 PID 2560 wrote to memory of 2000 2560 8DE8.tmp 93 PID 2560 wrote to memory of 2000 2560 8DE8.tmp 93 PID 2000 wrote to memory of 1592 2000 8EF2.tmp 94 PID 2000 wrote to memory of 1592 2000 8EF2.tmp 94 PID 2000 wrote to memory of 1592 2000 8EF2.tmp 94 PID 1592 wrote to memory of 2584 1592 8FCC.tmp 95 PID 1592 wrote to memory of 2584 1592 8FCC.tmp 95 PID 1592 wrote to memory of 2584 1592 8FCC.tmp 95 PID 2584 wrote to memory of 3592 2584 9069.tmp 96 PID 2584 wrote to memory of 3592 2584 9069.tmp 96 PID 2584 wrote to memory of 3592 2584 9069.tmp 96 PID 3592 wrote to memory of 1648 3592 9105.tmp 97 PID 3592 wrote to memory of 1648 3592 9105.tmp 97 PID 3592 wrote to memory of 1648 3592 9105.tmp 97 PID 1648 wrote to memory of 1116 1648 91C0.tmp 100 PID 1648 wrote to memory of 1116 1648 91C0.tmp 100 PID 1648 wrote to memory of 1116 1648 91C0.tmp 100 PID 1116 wrote to memory of 4860 1116 924D.tmp 101 PID 1116 wrote to memory of 4860 1116 924D.tmp 101 PID 1116 wrote to memory of 4860 1116 924D.tmp 101 PID 4860 wrote to memory of 924 4860 92E9.tmp 102 PID 4860 wrote to memory of 924 4860 92E9.tmp 102 PID 4860 wrote to memory of 924 4860 92E9.tmp 102 PID 924 wrote to memory of 5088 924 9395.tmp 103 PID 924 wrote to memory of 5088 924 9395.tmp 103 PID 924 wrote to memory of 5088 924 9395.tmp 103 PID 5088 wrote to memory of 4576 5088 9422.tmp 104 PID 5088 wrote to memory of 4576 5088 9422.tmp 104 PID 5088 wrote to memory of 4576 5088 9422.tmp 104 PID 4576 wrote to memory of 3804 4576 949F.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\de75b243731b3384b97fca46e8b0a0e9_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"C:\Users\Admin\AppData\Local\Temp\8EF2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"23⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"24⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"25⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"26⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"27⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"28⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"29⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"30⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"31⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"32⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"C:\Users\Admin\AppData\Local\Temp\9C6F.tmp"33⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"34⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"35⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"36⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"37⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"38⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"39⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"40⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"41⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"42⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"43⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"44⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"45⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"46⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"47⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"48⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"C:\Users\Admin\AppData\Local\Temp\A5A6.tmp"49⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"50⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"51⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"52⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"53⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"54⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"55⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"56⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"57⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"58⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"59⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"60⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"61⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"62⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"63⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"64⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"66⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"C:\Users\Admin\AppData\Local\Temp\AFE7.tmp"67⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"68⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"69⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"70⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"71⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"72⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\B258.tmp"C:\Users\Admin\AppData\Local\Temp\B258.tmp"73⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"74⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"75⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"76⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"77⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"78⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"79⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"80⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"81⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"82⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"83⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"84⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"85⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"86⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"87⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"88⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"89⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"90⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"91⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"92⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"93⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"94⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"C:\Users\Admin\AppData\Local\Temp\BCE7.tmp"95⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\BD83.tmp"C:\Users\Admin\AppData\Local\Temp\BD83.tmp"96⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"97⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"98⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"99⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"100⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"101⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"102⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C16B.tmp"C:\Users\Admin\AppData\Local\Temp\C16B.tmp"103⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"104⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"105⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"106⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"107⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"108⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"109⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"110⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"111⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"112⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"113⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\C747.tmp"C:\Users\Admin\AppData\Local\Temp\C747.tmp"114⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"C:\Users\Admin\AppData\Local\Temp\C7B5.tmp"115⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"116⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"117⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"118⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"119⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"120⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"C:\Users\Admin\AppData\Local\Temp\CB6E.tmp"121⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"122⤵PID:3624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-