Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 14:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe
-
Size
520KB
-
MD5
2ad97fae6ccf50fe28d5746dfc29b84d
-
SHA1
4bad09d87e882afdca4d5789491030380aad359a
-
SHA256
e55a57423407671c314ff92f6fe26e262bf5fdf3919c2918058b76a8ad747910
-
SHA512
88b3b55464707934c197ee984f7026330d6ecf8b00ecdbf56270955324e4d5d52fe68d881df350c4caa30b2cbb2a20cb8f1f6dd7b82b98ec760cc1c3d9f0c04f
-
SSDEEP
12288:YcRnG07aWi9a15I4DSvQYtU6QrFFxgRQlNZ:YcI0Bi9r/vQKTtuN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4332 7649.tmp 3024 7724.tmp 1880 785C.tmp 1496 78F9.tmp 3656 79E3.tmp 2072 7A9E.tmp 3708 7B3B.tmp 2164 7BF6.tmp 4596 7CB2.tmp 1364 7D8C.tmp 4696 7E58.tmp 3064 7FA0.tmp 1884 806B.tmp 2068 8155.tmp 4352 8201.tmp 232 82DC.tmp 3544 8359.tmp 5092 8443.tmp 4072 84C0.tmp 3984 85AB.tmp 3360 8656.tmp 5028 8712.tmp 2348 87CD.tmp 4636 8879.tmp 4376 8925.tmp 1112 89C1.tmp 1800 8A7D.tmp 4476 8B19.tmp 1228 8BA6.tmp 1092 8C32.tmp 1868 8CDE.tmp 2412 8D9A.tmp 1204 8E65.tmp 892 8F4F.tmp 3564 900B.tmp 3812 9097.tmp 3356 9114.tmp 4356 91A1.tmp 4532 924D.tmp 2056 9308.tmp 3700 9395.tmp 2212 9422.tmp 4236 94AE.tmp 3628 951C.tmp 3956 95A8.tmp 400 9625.tmp 3368 96B2.tmp 3660 971F.tmp 1564 97BC.tmp 1460 9858.tmp 2308 98F4.tmp 3508 9961.tmp 2248 99FE.tmp 2552 9AAA.tmp 1576 9B36.tmp 4244 9BD2.tmp 1160 9C8E.tmp 3340 9D1B.tmp 4720 9D88.tmp 5064 9E15.tmp 2072 9E92.tmp 2944 9EFF.tmp 2948 9F7C.tmp 1412 A018.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 4332 3264 2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe 83 PID 3264 wrote to memory of 4332 3264 2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe 83 PID 3264 wrote to memory of 4332 3264 2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe 83 PID 4332 wrote to memory of 3024 4332 7649.tmp 84 PID 4332 wrote to memory of 3024 4332 7649.tmp 84 PID 4332 wrote to memory of 3024 4332 7649.tmp 84 PID 3024 wrote to memory of 1880 3024 7724.tmp 85 PID 3024 wrote to memory of 1880 3024 7724.tmp 85 PID 3024 wrote to memory of 1880 3024 7724.tmp 85 PID 1880 wrote to memory of 1496 1880 785C.tmp 86 PID 1880 wrote to memory of 1496 1880 785C.tmp 86 PID 1880 wrote to memory of 1496 1880 785C.tmp 86 PID 1496 wrote to memory of 3656 1496 78F9.tmp 87 PID 1496 wrote to memory of 3656 1496 78F9.tmp 87 PID 1496 wrote to memory of 3656 1496 78F9.tmp 87 PID 3656 wrote to memory of 2072 3656 79E3.tmp 88 PID 3656 wrote to memory of 2072 3656 79E3.tmp 88 PID 3656 wrote to memory of 2072 3656 79E3.tmp 88 PID 2072 wrote to memory of 3708 2072 7A9E.tmp 89 PID 2072 wrote to memory of 3708 2072 7A9E.tmp 89 PID 2072 wrote to memory of 3708 2072 7A9E.tmp 89 PID 3708 wrote to memory of 2164 3708 7B3B.tmp 90 PID 3708 wrote to memory of 2164 3708 7B3B.tmp 90 PID 3708 wrote to memory of 2164 3708 7B3B.tmp 90 PID 2164 wrote to memory of 4596 2164 7BF6.tmp 91 PID 2164 wrote to memory of 4596 2164 7BF6.tmp 91 PID 2164 wrote to memory of 4596 2164 7BF6.tmp 91 PID 4596 wrote to memory of 1364 4596 7CB2.tmp 92 PID 4596 wrote to memory of 1364 4596 7CB2.tmp 92 PID 4596 wrote to memory of 1364 4596 7CB2.tmp 92 PID 1364 wrote to memory of 4696 1364 7D8C.tmp 93 PID 1364 wrote to memory of 4696 1364 7D8C.tmp 93 PID 1364 wrote to memory of 4696 1364 7D8C.tmp 93 PID 4696 wrote to memory of 3064 4696 7E58.tmp 94 PID 4696 wrote to memory of 3064 4696 7E58.tmp 94 PID 4696 wrote to memory of 3064 4696 7E58.tmp 94 PID 3064 wrote to memory of 1884 3064 7FA0.tmp 95 PID 3064 wrote to memory of 1884 3064 7FA0.tmp 95 PID 3064 wrote to memory of 1884 3064 7FA0.tmp 95 PID 1884 wrote to memory of 2068 1884 806B.tmp 96 PID 1884 wrote to memory of 2068 1884 806B.tmp 96 PID 1884 wrote to memory of 2068 1884 806B.tmp 96 PID 2068 wrote to memory of 4352 2068 8155.tmp 97 PID 2068 wrote to memory of 4352 2068 8155.tmp 97 PID 2068 wrote to memory of 4352 2068 8155.tmp 97 PID 4352 wrote to memory of 232 4352 8201.tmp 98 PID 4352 wrote to memory of 232 4352 8201.tmp 98 PID 4352 wrote to memory of 232 4352 8201.tmp 98 PID 232 wrote to memory of 3544 232 82DC.tmp 99 PID 232 wrote to memory of 3544 232 82DC.tmp 99 PID 232 wrote to memory of 3544 232 82DC.tmp 99 PID 3544 wrote to memory of 5092 3544 8359.tmp 100 PID 3544 wrote to memory of 5092 3544 8359.tmp 100 PID 3544 wrote to memory of 5092 3544 8359.tmp 100 PID 5092 wrote to memory of 4072 5092 8443.tmp 103 PID 5092 wrote to memory of 4072 5092 8443.tmp 103 PID 5092 wrote to memory of 4072 5092 8443.tmp 103 PID 4072 wrote to memory of 3984 4072 84C0.tmp 104 PID 4072 wrote to memory of 3984 4072 84C0.tmp 104 PID 4072 wrote to memory of 3984 4072 84C0.tmp 104 PID 3984 wrote to memory of 3360 3984 85AB.tmp 105 PID 3984 wrote to memory of 3360 3984 85AB.tmp 105 PID 3984 wrote to memory of 3360 3984 85AB.tmp 105 PID 3360 wrote to memory of 5028 3360 8656.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2ad97fae6ccf50fe28d5746dfc29b84d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"C:\Users\Admin\AppData\Local\Temp\7A9E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"23⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"24⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"25⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"26⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"27⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"28⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"29⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"30⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"31⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"32⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"33⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"34⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"35⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"36⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\9097.tmp"C:\Users\Admin\AppData\Local\Temp\9097.tmp"37⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"38⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"39⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"40⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"41⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"42⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"43⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"44⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"45⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"46⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"47⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"48⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"49⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\97BC.tmp"C:\Users\Admin\AppData\Local\Temp\97BC.tmp"50⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"51⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"52⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"53⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"54⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"55⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"56⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"57⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"58⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"59⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"60⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"61⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"62⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"63⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"64⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"65⤵
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"66⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"67⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"68⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"69⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"70⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"71⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"72⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"73⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"74⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"75⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"76⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"77⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"78⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"79⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"80⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"81⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"82⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"83⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"84⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"85⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"86⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"87⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"88⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"89⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"90⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"91⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"92⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"93⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"94⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"95⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\B045.tmp"C:\Users\Admin\AppData\Local\Temp\B045.tmp"96⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"97⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"98⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"99⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"100⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"101⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"C:\Users\Admin\AppData\Local\Temp\B3A0.tmp"102⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B44C.tmp"C:\Users\Admin\AppData\Local\Temp\B44C.tmp"103⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"104⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"105⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"106⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"107⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"108⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"109⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"110⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"111⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"112⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"113⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"114⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"115⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"116⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"117⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"118⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"119⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"120⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"121⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"122⤵PID:4560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-