Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe
-
Size
486KB
-
MD5
24eba2a4d7c0f12f0964ba59b34a1940
-
SHA1
70b8bbee77df9ad21032647c37fae74689488fd9
-
SHA256
e989835827bcf9db995e93f0b4d0495ec3e4169b36913c0c130160901a37c651
-
SHA512
77855ed374f1f6893204668f60a2875e6aeeaef397bacf66601e3549112e3b7aa6156425271ae6882272d9468e58d1e7d217ffc5e864a7a6438f9fd64530f5b4
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7nYulVeT8fLTYfUCP5rGY2cmJKv4Wij33KXsz:/U5rCOTeiDn/KTeXYfhVGLcyi4DHNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 220 70EA.tmp 228 71A6.tmp 3448 7280.tmp 2928 733C.tmp 4984 7407.tmp 1796 74B3.tmp 4280 75BC.tmp 1048 7639.tmp 1576 7733.tmp 1772 781E.tmp 4848 78BA.tmp 952 7956.tmp 4760 79D3.tmp 4252 7ADD.tmp 4648 7BB8.tmp 2704 7C64.tmp 4872 7D00.tmp 4152 7DDB.tmp 4704 7E96.tmp 1856 7F61.tmp 972 7FCF.tmp 4452 809A.tmp 4424 8174.tmp 2444 8220.tmp 5032 82EB.tmp 3148 8378.tmp 4772 8443.tmp 1908 84C0.tmp 4532 8608.tmp 2912 86E3.tmp 4256 877F.tmp 1116 883B.tmp 4972 88E7.tmp 1124 8964.tmp 4124 89C1.tmp 3424 8A5E.tmp 3864 8AFA.tmp 4112 8B77.tmp 920 8C13.tmp 5084 8CAF.tmp 1416 8D3C.tmp 4208 8DC9.tmp 1496 8E46.tmp 2916 8EE2.tmp 3620 8F7E.tmp 3312 902A.tmp 2200 90C6.tmp 3692 9163.tmp 408 91E0.tmp 2648 925D.tmp 180 9308.tmp 4356 9385.tmp 220 9412.tmp 1428 949F.tmp 1512 950C.tmp 1148 9589.tmp 3832 9635.tmp 1956 96A2.tmp 1220 971F.tmp 1992 979C.tmp 2260 9839.tmp 2248 98B6.tmp 1376 9923.tmp 3240 99A0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4736 wrote to memory of 220 4736 24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe 82 PID 4736 wrote to memory of 220 4736 24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe 82 PID 4736 wrote to memory of 220 4736 24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe 82 PID 220 wrote to memory of 228 220 70EA.tmp 83 PID 220 wrote to memory of 228 220 70EA.tmp 83 PID 220 wrote to memory of 228 220 70EA.tmp 83 PID 228 wrote to memory of 3448 228 71A6.tmp 84 PID 228 wrote to memory of 3448 228 71A6.tmp 84 PID 228 wrote to memory of 3448 228 71A6.tmp 84 PID 3448 wrote to memory of 2928 3448 7280.tmp 85 PID 3448 wrote to memory of 2928 3448 7280.tmp 85 PID 3448 wrote to memory of 2928 3448 7280.tmp 85 PID 2928 wrote to memory of 4984 2928 733C.tmp 86 PID 2928 wrote to memory of 4984 2928 733C.tmp 86 PID 2928 wrote to memory of 4984 2928 733C.tmp 86 PID 4984 wrote to memory of 1796 4984 7407.tmp 87 PID 4984 wrote to memory of 1796 4984 7407.tmp 87 PID 4984 wrote to memory of 1796 4984 7407.tmp 87 PID 1796 wrote to memory of 4280 1796 74B3.tmp 88 PID 1796 wrote to memory of 4280 1796 74B3.tmp 88 PID 1796 wrote to memory of 4280 1796 74B3.tmp 88 PID 4280 wrote to memory of 1048 4280 75BC.tmp 89 PID 4280 wrote to memory of 1048 4280 75BC.tmp 89 PID 4280 wrote to memory of 1048 4280 75BC.tmp 89 PID 1048 wrote to memory of 1576 1048 7639.tmp 90 PID 1048 wrote to memory of 1576 1048 7639.tmp 90 PID 1048 wrote to memory of 1576 1048 7639.tmp 90 PID 1576 wrote to memory of 1772 1576 7733.tmp 91 PID 1576 wrote to memory of 1772 1576 7733.tmp 91 PID 1576 wrote to memory of 1772 1576 7733.tmp 91 PID 1772 wrote to memory of 4848 1772 781E.tmp 92 PID 1772 wrote to memory of 4848 1772 781E.tmp 92 PID 1772 wrote to memory of 4848 1772 781E.tmp 92 PID 4848 wrote to memory of 952 4848 78BA.tmp 93 PID 4848 wrote to memory of 952 4848 78BA.tmp 93 PID 4848 wrote to memory of 952 4848 78BA.tmp 93 PID 952 wrote to memory of 4760 952 7956.tmp 94 PID 952 wrote to memory of 4760 952 7956.tmp 94 PID 952 wrote to memory of 4760 952 7956.tmp 94 PID 4760 wrote to memory of 4252 4760 79D3.tmp 95 PID 4760 wrote to memory of 4252 4760 79D3.tmp 95 PID 4760 wrote to memory of 4252 4760 79D3.tmp 95 PID 4252 wrote to memory of 4648 4252 7ADD.tmp 96 PID 4252 wrote to memory of 4648 4252 7ADD.tmp 96 PID 4252 wrote to memory of 4648 4252 7ADD.tmp 96 PID 4648 wrote to memory of 2704 4648 7BB8.tmp 97 PID 4648 wrote to memory of 2704 4648 7BB8.tmp 97 PID 4648 wrote to memory of 2704 4648 7BB8.tmp 97 PID 2704 wrote to memory of 4872 2704 7C64.tmp 98 PID 2704 wrote to memory of 4872 2704 7C64.tmp 98 PID 2704 wrote to memory of 4872 2704 7C64.tmp 98 PID 4872 wrote to memory of 4152 4872 7D00.tmp 101 PID 4872 wrote to memory of 4152 4872 7D00.tmp 101 PID 4872 wrote to memory of 4152 4872 7D00.tmp 101 PID 4152 wrote to memory of 4704 4152 7DDB.tmp 102 PID 4152 wrote to memory of 4704 4152 7DDB.tmp 102 PID 4152 wrote to memory of 4704 4152 7DDB.tmp 102 PID 4704 wrote to memory of 1856 4704 7E96.tmp 103 PID 4704 wrote to memory of 1856 4704 7E96.tmp 103 PID 4704 wrote to memory of 1856 4704 7E96.tmp 103 PID 1856 wrote to memory of 972 1856 7F61.tmp 104 PID 1856 wrote to memory of 972 1856 7F61.tmp 104 PID 1856 wrote to memory of 972 1856 7F61.tmp 104 PID 972 wrote to memory of 4452 972 7FCF.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\24eba2a4d7c0f12f0964ba59b34a1940_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"C:\Users\Admin\AppData\Local\Temp\7ADD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\7F61.tmp"C:\Users\Admin\AppData\Local\Temp\7F61.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"23⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8174.tmp"C:\Users\Admin\AppData\Local\Temp\8174.tmp"24⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"25⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"26⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8378.tmp"C:\Users\Admin\AppData\Local\Temp\8378.tmp"27⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"28⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"29⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"30⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"31⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"32⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"33⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"34⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"35⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"36⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"37⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"38⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"39⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"40⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"41⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"42⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"43⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"44⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"C:\Users\Admin\AppData\Local\Temp\8EE2.tmp"45⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"46⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"47⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"48⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"49⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"50⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"51⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"52⤵
- Executes dropped EXE
PID:180 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"53⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"54⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"55⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"56⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"57⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"58⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"59⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"60⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"61⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"62⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"63⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"64⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"65⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"66⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"67⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"68⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"C:\Users\Admin\AppData\Local\Temp\9BF2.tmp"69⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"70⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"71⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"72⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"73⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"74⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"75⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"76⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"77⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"78⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"79⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"80⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"81⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"82⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"83⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"84⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"85⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"86⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"88⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"89⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"90⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"91⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"92⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"93⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"94⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"95⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"96⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"C:\Users\Admin\AppData\Local\Temp\AAE6.tmp"97⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"98⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"100⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"C:\Users\Admin\AppData\Local\Temp\ACDA.tmp"101⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"102⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"103⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"104⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"105⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"106⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"107⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"C:\Users\Admin\AppData\Local\Temp\B0B2.tmp"108⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"109⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"110⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"111⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"112⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"113⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"114⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"115⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"116⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"117⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"118⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"119⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"120⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"121⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"122⤵PID:1796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-