Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 13:55
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe
-
Size
486KB
-
MD5
e8c13041c1a0d45bf39d7afaf045e271
-
SHA1
f4f5fdb3b4d2dfc0b78e16663d1293dad918fc8a
-
SHA256
425a02b08f09e5c6bf365ac19c43f5bfc41caca1ef691a829f735b877ee8043e
-
SHA512
05a53ab77418197ff5602ab57d42501f7bad073d9eb1f92f58d95fe9f26dc88b08268fa010008c2d3698035d35cefc6aa0410817fbd693767d3dfeec45c11444
-
SSDEEP
12288:/U5rCOTeiDLqEKrrJaO1Jcm/TG1y9CuINZ:/UQOJD+HrJaKa2TG1iCuIN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1372 8A1F.tmp 668 8ACB.tmp 32 8B87.tmp 4560 8C42.tmp 3472 8D2C.tmp 2580 8D9A.tmp 4440 8F01.tmp 3428 8FBD.tmp 4796 9059.tmp 1868 90E6.tmp 5072 9172.tmp 3520 924D.tmp 2912 92AB.tmp 4964 9347.tmp 1560 93F3.tmp 4700 947F.tmp 2372 950C.tmp 5096 95C8.tmp 4476 9645.tmp 836 96C2.tmp 5016 97AC.tmp 3716 9867.tmp 2644 9942.tmp 4612 99EE.tmp 2904 9A6B.tmp 4776 9B46.tmp 5008 9C21.tmp 4216 9CCC.tmp 4360 9D49.tmp 5028 9E43.tmp 364 9EE0.tmp 3064 9FE9.tmp 1568 A095.tmp 1664 A122.tmp 1660 A1AE.tmp 4300 A24B.tmp 4956 A2C8.tmp 264 A3D1.tmp 2448 A45E.tmp 2952 A4EB.tmp 1704 A577.tmp 4944 A5F4.tmp 668 A662.tmp 2224 A6BF.tmp 824 A74C.tmp 2160 A7D9.tmp 4192 A875.tmp 4000 A911.tmp 4908 A98E.tmp 4488 A9FB.tmp 2988 AA69.tmp 1528 AAD6.tmp 4572 AB72.tmp 1652 ABFF.tmp 3952 AC8C.tmp 452 AD38.tmp 4768 ADC4.tmp 1012 AE60.tmp 1044 AF0C.tmp 4796 AF89.tmp 4104 AFF7.tmp 3616 B083.tmp 1868 B120.tmp 2504 B19D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3684 wrote to memory of 1372 3684 2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe 84 PID 3684 wrote to memory of 1372 3684 2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe 84 PID 3684 wrote to memory of 1372 3684 2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe 84 PID 1372 wrote to memory of 668 1372 8A1F.tmp 85 PID 1372 wrote to memory of 668 1372 8A1F.tmp 85 PID 1372 wrote to memory of 668 1372 8A1F.tmp 85 PID 668 wrote to memory of 32 668 8ACB.tmp 86 PID 668 wrote to memory of 32 668 8ACB.tmp 86 PID 668 wrote to memory of 32 668 8ACB.tmp 86 PID 32 wrote to memory of 4560 32 8B87.tmp 87 PID 32 wrote to memory of 4560 32 8B87.tmp 87 PID 32 wrote to memory of 4560 32 8B87.tmp 87 PID 4560 wrote to memory of 3472 4560 8C42.tmp 88 PID 4560 wrote to memory of 3472 4560 8C42.tmp 88 PID 4560 wrote to memory of 3472 4560 8C42.tmp 88 PID 3472 wrote to memory of 2580 3472 8D2C.tmp 90 PID 3472 wrote to memory of 2580 3472 8D2C.tmp 90 PID 3472 wrote to memory of 2580 3472 8D2C.tmp 90 PID 2580 wrote to memory of 4440 2580 8D9A.tmp 91 PID 2580 wrote to memory of 4440 2580 8D9A.tmp 91 PID 2580 wrote to memory of 4440 2580 8D9A.tmp 91 PID 4440 wrote to memory of 3428 4440 8F01.tmp 92 PID 4440 wrote to memory of 3428 4440 8F01.tmp 92 PID 4440 wrote to memory of 3428 4440 8F01.tmp 92 PID 3428 wrote to memory of 4796 3428 8FBD.tmp 93 PID 3428 wrote to memory of 4796 3428 8FBD.tmp 93 PID 3428 wrote to memory of 4796 3428 8FBD.tmp 93 PID 4796 wrote to memory of 1868 4796 9059.tmp 94 PID 4796 wrote to memory of 1868 4796 9059.tmp 94 PID 4796 wrote to memory of 1868 4796 9059.tmp 94 PID 1868 wrote to memory of 5072 1868 90E6.tmp 95 PID 1868 wrote to memory of 5072 1868 90E6.tmp 95 PID 1868 wrote to memory of 5072 1868 90E6.tmp 95 PID 5072 wrote to memory of 3520 5072 9172.tmp 96 PID 5072 wrote to memory of 3520 5072 9172.tmp 96 PID 5072 wrote to memory of 3520 5072 9172.tmp 96 PID 3520 wrote to memory of 2912 3520 924D.tmp 97 PID 3520 wrote to memory of 2912 3520 924D.tmp 97 PID 3520 wrote to memory of 2912 3520 924D.tmp 97 PID 2912 wrote to memory of 4964 2912 92AB.tmp 98 PID 2912 wrote to memory of 4964 2912 92AB.tmp 98 PID 2912 wrote to memory of 4964 2912 92AB.tmp 98 PID 4964 wrote to memory of 1560 4964 9347.tmp 99 PID 4964 wrote to memory of 1560 4964 9347.tmp 99 PID 4964 wrote to memory of 1560 4964 9347.tmp 99 PID 1560 wrote to memory of 4700 1560 93F3.tmp 100 PID 1560 wrote to memory of 4700 1560 93F3.tmp 100 PID 1560 wrote to memory of 4700 1560 93F3.tmp 100 PID 4700 wrote to memory of 2372 4700 947F.tmp 101 PID 4700 wrote to memory of 2372 4700 947F.tmp 101 PID 4700 wrote to memory of 2372 4700 947F.tmp 101 PID 2372 wrote to memory of 5096 2372 950C.tmp 102 PID 2372 wrote to memory of 5096 2372 950C.tmp 102 PID 2372 wrote to memory of 5096 2372 950C.tmp 102 PID 5096 wrote to memory of 4476 5096 95C8.tmp 103 PID 5096 wrote to memory of 4476 5096 95C8.tmp 103 PID 5096 wrote to memory of 4476 5096 95C8.tmp 103 PID 4476 wrote to memory of 836 4476 9645.tmp 104 PID 4476 wrote to memory of 836 4476 9645.tmp 104 PID 4476 wrote to memory of 836 4476 9645.tmp 104 PID 836 wrote to memory of 5016 836 96C2.tmp 105 PID 836 wrote to memory of 5016 836 96C2.tmp 105 PID 836 wrote to memory of 5016 836 96C2.tmp 105 PID 5016 wrote to memory of 3716 5016 97AC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_e8c13041c1a0d45bf39d7afaf045e271_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"23⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\9942.tmp"C:\Users\Admin\AppData\Local\Temp\9942.tmp"24⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"25⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"26⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"27⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"28⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"29⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"30⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"31⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"32⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"33⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"34⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"35⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"36⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"37⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"38⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"39⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"40⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\A45E.tmp"C:\Users\Admin\AppData\Local\Temp\A45E.tmp"41⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"42⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"43⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"44⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"45⤵
- Executes dropped EXE
PID:668 -
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"46⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"47⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"48⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"49⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"50⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"51⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"52⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\AA69.tmp"C:\Users\Admin\AppData\Local\Temp\AA69.tmp"53⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"54⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"55⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"C:\Users\Admin\AppData\Local\Temp\ABFF.tmp"56⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"57⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"58⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"59⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"60⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"61⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"62⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"63⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"64⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"65⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"66⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"67⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"68⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\B323.tmp"C:\Users\Admin\AppData\Local\Temp\B323.tmp"69⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"70⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"71⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"72⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"73⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"74⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"75⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"76⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"77⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"78⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"79⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"80⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"81⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"82⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"83⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"84⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"85⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"C:\Users\Admin\AppData\Local\Temp\BBFD.tmp"86⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"C:\Users\Admin\AppData\Local\Temp\BC6A.tmp"87⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"88⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\BD64.tmp"C:\Users\Admin\AppData\Local\Temp\BD64.tmp"89⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"90⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"91⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"92⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"93⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"94⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"95⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"96⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"97⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"98⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"C:\Users\Admin\AppData\Local\Temp\C2B4.tmp"99⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"100⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"101⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"102⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"103⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"104⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"105⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"106⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"107⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"108⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"109⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"110⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"111⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"112⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"113⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"114⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"C:\Users\Admin\AppData\Local\Temp\CB5E.tmp"115⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"116⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"117⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"118⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\CD62.tmp"C:\Users\Admin\AppData\Local\Temp\CD62.tmp"119⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"120⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"121⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-