Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2023, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
546afbe41de883652b8a6c93d90ee562_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
546afbe41de883652b8a6c93d90ee562_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
546afbe41de883652b8a6c93d90ee562_mafia_JC.exe
-
Size
486KB
-
MD5
546afbe41de883652b8a6c93d90ee562
-
SHA1
bcee8ffe5a4a9a70755e80faeccbd86fbbf4cbd6
-
SHA256
77b2a22c3ab72192cca3608b50e685e1d9d84a9844f5d94e16e2832c6d3c668f
-
SHA512
37875bf1770d2278f3baaaa0352009af04901a0f585d8c8215268fb8e8c1ff3377903961bfcde5642b0b5c6250932b7b4decfc998d48a3a2b40f53c2a914cadf
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7YZFKY0QZ/4tVu4xcXFskKjHk80lLL8oSsg6n:/U5rCOTeiDNw4tVuwcXFsxjIM6JhNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 680 B045.tmp 3408 B13F.tmp 3840 B21A.tmp 4248 B2E5.tmp 3416 B3DF.tmp 1976 B47B.tmp 1840 B527.tmp 4488 B602.tmp 4024 B6DC.tmp 540 B788.tmp 4888 B834.tmp 2988 B91E.tmp 1384 B9CA.tmp 3116 BAE4.tmp 3776 BB70.tmp 1208 BC0C.tmp 3352 BCC8.tmp 396 BD74.tmp 4180 BE4F.tmp 3276 BEDB.tmp 3204 BFD5.tmp 3824 C0B0.tmp 380 C17B.tmp 4672 C227.tmp 3156 C2E2.tmp 4772 C36F.tmp 3772 C40B.tmp 3652 C4B7.tmp 1212 C592.tmp 2904 C67C.tmp 4912 C728.tmp 3392 C803.tmp 848 C8ED.tmp 2052 C98A.tmp 2876 CAA3.tmp 4680 CB4F.tmp 3796 CBDB.tmp 2784 CC58.tmp 1356 CCE5.tmp 1584 CD72.tmp 1516 CE2D.tmp 1936 CED9.tmp 2380 CF85.tmp 1092 D031.tmp 3152 D0CD.tmp 1676 D179.tmp 2212 D225.tmp 3180 D2C1.tmp 800 D34E.tmp 2176 D3DA.tmp 3416 D457.tmp 4580 D4D4.tmp 2368 D561.tmp 1840 D5FD.tmp 528 D6A9.tmp 2900 D736.tmp 5048 D7C2.tmp 540 D86E.tmp 3764 D90A.tmp 3112 D9A7.tmp 4832 DA24.tmp 1208 DA91.tmp 2724 DB0E.tmp 2908 DB7B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 680 2720 546afbe41de883652b8a6c93d90ee562_mafia_JC.exe 86 PID 2720 wrote to memory of 680 2720 546afbe41de883652b8a6c93d90ee562_mafia_JC.exe 86 PID 2720 wrote to memory of 680 2720 546afbe41de883652b8a6c93d90ee562_mafia_JC.exe 86 PID 680 wrote to memory of 3408 680 B045.tmp 87 PID 680 wrote to memory of 3408 680 B045.tmp 87 PID 680 wrote to memory of 3408 680 B045.tmp 87 PID 3408 wrote to memory of 3840 3408 B13F.tmp 88 PID 3408 wrote to memory of 3840 3408 B13F.tmp 88 PID 3408 wrote to memory of 3840 3408 B13F.tmp 88 PID 3840 wrote to memory of 4248 3840 B21A.tmp 89 PID 3840 wrote to memory of 4248 3840 B21A.tmp 89 PID 3840 wrote to memory of 4248 3840 B21A.tmp 89 PID 4248 wrote to memory of 3416 4248 B2E5.tmp 90 PID 4248 wrote to memory of 3416 4248 B2E5.tmp 90 PID 4248 wrote to memory of 3416 4248 B2E5.tmp 90 PID 3416 wrote to memory of 1976 3416 B3DF.tmp 91 PID 3416 wrote to memory of 1976 3416 B3DF.tmp 91 PID 3416 wrote to memory of 1976 3416 B3DF.tmp 91 PID 1976 wrote to memory of 1840 1976 B47B.tmp 92 PID 1976 wrote to memory of 1840 1976 B47B.tmp 92 PID 1976 wrote to memory of 1840 1976 B47B.tmp 92 PID 1840 wrote to memory of 4488 1840 B527.tmp 93 PID 1840 wrote to memory of 4488 1840 B527.tmp 93 PID 1840 wrote to memory of 4488 1840 B527.tmp 93 PID 4488 wrote to memory of 4024 4488 B602.tmp 94 PID 4488 wrote to memory of 4024 4488 B602.tmp 94 PID 4488 wrote to memory of 4024 4488 B602.tmp 94 PID 4024 wrote to memory of 540 4024 B6DC.tmp 95 PID 4024 wrote to memory of 540 4024 B6DC.tmp 95 PID 4024 wrote to memory of 540 4024 B6DC.tmp 95 PID 540 wrote to memory of 4888 540 B788.tmp 96 PID 540 wrote to memory of 4888 540 B788.tmp 96 PID 540 wrote to memory of 4888 540 B788.tmp 96 PID 4888 wrote to memory of 2988 4888 B834.tmp 97 PID 4888 wrote to memory of 2988 4888 B834.tmp 97 PID 4888 wrote to memory of 2988 4888 B834.tmp 97 PID 2988 wrote to memory of 1384 2988 B91E.tmp 98 PID 2988 wrote to memory of 1384 2988 B91E.tmp 98 PID 2988 wrote to memory of 1384 2988 B91E.tmp 98 PID 1384 wrote to memory of 3116 1384 B9CA.tmp 99 PID 1384 wrote to memory of 3116 1384 B9CA.tmp 99 PID 1384 wrote to memory of 3116 1384 B9CA.tmp 99 PID 3116 wrote to memory of 3776 3116 BAE4.tmp 100 PID 3116 wrote to memory of 3776 3116 BAE4.tmp 100 PID 3116 wrote to memory of 3776 3116 BAE4.tmp 100 PID 3776 wrote to memory of 1208 3776 BB70.tmp 101 PID 3776 wrote to memory of 1208 3776 BB70.tmp 101 PID 3776 wrote to memory of 1208 3776 BB70.tmp 101 PID 1208 wrote to memory of 3352 1208 BC0C.tmp 102 PID 1208 wrote to memory of 3352 1208 BC0C.tmp 102 PID 1208 wrote to memory of 3352 1208 BC0C.tmp 102 PID 3352 wrote to memory of 396 3352 BCC8.tmp 105 PID 3352 wrote to memory of 396 3352 BCC8.tmp 105 PID 3352 wrote to memory of 396 3352 BCC8.tmp 105 PID 396 wrote to memory of 4180 396 BD74.tmp 106 PID 396 wrote to memory of 4180 396 BD74.tmp 106 PID 396 wrote to memory of 4180 396 BD74.tmp 106 PID 4180 wrote to memory of 3276 4180 BE4F.tmp 107 PID 4180 wrote to memory of 3276 4180 BE4F.tmp 107 PID 4180 wrote to memory of 3276 4180 BE4F.tmp 107 PID 3276 wrote to memory of 3204 3276 BEDB.tmp 108 PID 3276 wrote to memory of 3204 3276 BEDB.tmp 108 PID 3276 wrote to memory of 3204 3276 BEDB.tmp 108 PID 3204 wrote to memory of 3824 3204 BFD5.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\546afbe41de883652b8a6c93d90ee562_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\546afbe41de883652b8a6c93d90ee562_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\B788.tmp"C:\Users\Admin\AppData\Local\Temp\B788.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\B91E.tmp"C:\Users\Admin\AppData\Local\Temp\B91E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"23⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"24⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"25⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"26⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"27⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"28⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"C:\Users\Admin\AppData\Local\Temp\C4B7.tmp"29⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"30⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\C67C.tmp"C:\Users\Admin\AppData\Local\Temp\C67C.tmp"31⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"32⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"33⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"34⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"35⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"36⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"37⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"38⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"39⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"40⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"41⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"42⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"43⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"44⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"45⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"46⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"47⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"48⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"49⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"50⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"51⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"52⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"53⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\D561.tmp"C:\Users\Admin\AppData\Local\Temp\D561.tmp"54⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"55⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"56⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"57⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"58⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"59⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"60⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"C:\Users\Admin\AppData\Local\Temp\D9A7.tmp"61⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\DA24.tmp"C:\Users\Admin\AppData\Local\Temp\DA24.tmp"62⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"63⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"64⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"65⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"C:\Users\Admin\AppData\Local\Temp\DBE9.tmp"66⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"67⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"C:\Users\Admin\AppData\Local\Temp\DCE3.tmp"68⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"69⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"C:\Users\Admin\AppData\Local\Temp\DE0C.tmp"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"71⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"72⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"73⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"74⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"75⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"76⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"77⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"78⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"79⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"80⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\E56E.tmp"C:\Users\Admin\AppData\Local\Temp\E56E.tmp"81⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"C:\Users\Admin\AppData\Local\Temp\E5EB.tmp"82⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"83⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"84⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"85⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"86⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"87⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\E89B.tmp"C:\Users\Admin\AppData\Local\Temp\E89B.tmp"88⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"89⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"90⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\EA50.tmp"C:\Users\Admin\AppData\Local\Temp\EA50.tmp"91⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"92⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"93⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"94⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\EC44.tmp"C:\Users\Admin\AppData\Local\Temp\EC44.tmp"95⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"96⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"C:\Users\Admin\AppData\Local\Temp\ED4E.tmp"97⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"98⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"99⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"C:\Users\Admin\AppData\Local\Temp\EEF4.tmp"100⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"101⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"102⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"103⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"104⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"105⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"106⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"107⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"108⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"109⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\F50E.tmp"C:\Users\Admin\AppData\Local\Temp\F50E.tmp"110⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"111⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\F627.tmp"C:\Users\Admin\AppData\Local\Temp\F627.tmp"112⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"113⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"114⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"115⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"116⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"117⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"118⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"119⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"120⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\FB58.tmp"C:\Users\Admin\AppData\Local\Temp\FB58.tmp"121⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"122⤵PID:3824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-