Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 15:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe
-
Size
486KB
-
MD5
324cf4c0528fd1a40fd13a54e6c4b1ad
-
SHA1
0993cb675dc8485391741b9b1825634f0be25b30
-
SHA256
cf8788f7cf71c7f52a56d7980e13281a27debf0839cd3fca5c9c1a065adc9f3a
-
SHA512
eb1f23b2f87ac7b83f1a25559c44e772bb453b1799012772fd28357e8ab3f169e713c825c3480db2a32f9cff578b6bbef843ab8512bb52dc1634e89618070506
-
SSDEEP
12288:UU5rCOTeiDmts4SAYuYhJBnMPU4D/vNZ:UUQOJDmtPSIYnBM8aN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5068 90E6.tmp 1656 9191.tmp 3448 922E.tmp 3784 9337.tmp 3240 93B4.tmp 1244 9451.tmp 864 94CE.tmp 3160 955A.tmp 1960 95D7.tmp 1620 96C2.tmp 1060 972F.tmp 3356 980A.tmp 4456 98C5.tmp 4604 9971.tmp 4784 9A7B.tmp 4724 9B46.tmp 4268 9BE2.tmp 2716 9CBD.tmp 5092 9D2A.tmp 1696 9DE6.tmp 1796 9E72.tmp 2056 9F3D.tmp 4064 9FCA.tmp 1876 A095.tmp 4332 A151.tmp 1536 A1DD.tmp 4256 A299.tmp 4192 A364.tmp 1592 A400.tmp 3796 A48D.tmp 2260 A548.tmp 3876 A633.tmp 1700 A6FE.tmp 3196 A76B.tmp 752 A7E8.tmp 3416 A875.tmp 4772 A911.tmp 4408 A98E.tmp 3436 AA1B.tmp 768 AAB7.tmp 4452 AB53.tmp 3636 ABD0.tmp 1580 AC7C.tmp 1888 ACF9.tmp 212 AD86.tmp 1340 AE03.tmp 4180 AE8F.tmp 4048 AF2C.tmp 1296 AFF7.tmp 4952 B083.tmp 4600 B100.tmp 4072 B1AC.tmp 4644 B239.tmp 5068 B2C5.tmp 4776 B362.tmp 1556 B3EE.tmp 1268 B47B.tmp 3208 B536.tmp 4556 B5C3.tmp 3784 B650.tmp 2468 B6DC.tmp 1240 B769.tmp 384 B7E6.tmp 4296 B873.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 5068 4460 324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe 82 PID 4460 wrote to memory of 5068 4460 324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe 82 PID 4460 wrote to memory of 5068 4460 324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe 82 PID 5068 wrote to memory of 1656 5068 90E6.tmp 83 PID 5068 wrote to memory of 1656 5068 90E6.tmp 83 PID 5068 wrote to memory of 1656 5068 90E6.tmp 83 PID 1656 wrote to memory of 3448 1656 9191.tmp 84 PID 1656 wrote to memory of 3448 1656 9191.tmp 84 PID 1656 wrote to memory of 3448 1656 9191.tmp 84 PID 3448 wrote to memory of 3784 3448 922E.tmp 85 PID 3448 wrote to memory of 3784 3448 922E.tmp 85 PID 3448 wrote to memory of 3784 3448 922E.tmp 85 PID 3784 wrote to memory of 3240 3784 9337.tmp 86 PID 3784 wrote to memory of 3240 3784 9337.tmp 86 PID 3784 wrote to memory of 3240 3784 9337.tmp 86 PID 3240 wrote to memory of 1244 3240 93B4.tmp 87 PID 3240 wrote to memory of 1244 3240 93B4.tmp 87 PID 3240 wrote to memory of 1244 3240 93B4.tmp 87 PID 1244 wrote to memory of 864 1244 9451.tmp 88 PID 1244 wrote to memory of 864 1244 9451.tmp 88 PID 1244 wrote to memory of 864 1244 9451.tmp 88 PID 864 wrote to memory of 3160 864 94CE.tmp 89 PID 864 wrote to memory of 3160 864 94CE.tmp 89 PID 864 wrote to memory of 3160 864 94CE.tmp 89 PID 3160 wrote to memory of 1960 3160 955A.tmp 90 PID 3160 wrote to memory of 1960 3160 955A.tmp 90 PID 3160 wrote to memory of 1960 3160 955A.tmp 90 PID 1960 wrote to memory of 1620 1960 95D7.tmp 92 PID 1960 wrote to memory of 1620 1960 95D7.tmp 92 PID 1960 wrote to memory of 1620 1960 95D7.tmp 92 PID 1620 wrote to memory of 1060 1620 96C2.tmp 93 PID 1620 wrote to memory of 1060 1620 96C2.tmp 93 PID 1620 wrote to memory of 1060 1620 96C2.tmp 93 PID 1060 wrote to memory of 3356 1060 972F.tmp 94 PID 1060 wrote to memory of 3356 1060 972F.tmp 94 PID 1060 wrote to memory of 3356 1060 972F.tmp 94 PID 3356 wrote to memory of 4456 3356 980A.tmp 95 PID 3356 wrote to memory of 4456 3356 980A.tmp 95 PID 3356 wrote to memory of 4456 3356 980A.tmp 95 PID 4456 wrote to memory of 4604 4456 98C5.tmp 96 PID 4456 wrote to memory of 4604 4456 98C5.tmp 96 PID 4456 wrote to memory of 4604 4456 98C5.tmp 96 PID 4604 wrote to memory of 4784 4604 9971.tmp 97 PID 4604 wrote to memory of 4784 4604 9971.tmp 97 PID 4604 wrote to memory of 4784 4604 9971.tmp 97 PID 4784 wrote to memory of 4724 4784 9A7B.tmp 98 PID 4784 wrote to memory of 4724 4784 9A7B.tmp 98 PID 4784 wrote to memory of 4724 4784 9A7B.tmp 98 PID 4724 wrote to memory of 4268 4724 9B46.tmp 99 PID 4724 wrote to memory of 4268 4724 9B46.tmp 99 PID 4724 wrote to memory of 4268 4724 9B46.tmp 99 PID 4268 wrote to memory of 2716 4268 9BE2.tmp 100 PID 4268 wrote to memory of 2716 4268 9BE2.tmp 100 PID 4268 wrote to memory of 2716 4268 9BE2.tmp 100 PID 2716 wrote to memory of 5092 2716 9CBD.tmp 101 PID 2716 wrote to memory of 5092 2716 9CBD.tmp 101 PID 2716 wrote to memory of 5092 2716 9CBD.tmp 101 PID 5092 wrote to memory of 1696 5092 9D2A.tmp 104 PID 5092 wrote to memory of 1696 5092 9D2A.tmp 104 PID 5092 wrote to memory of 1696 5092 9D2A.tmp 104 PID 1696 wrote to memory of 1796 1696 9DE6.tmp 105 PID 1696 wrote to memory of 1796 1696 9DE6.tmp 105 PID 1696 wrote to memory of 1796 1696 9DE6.tmp 105 PID 1796 wrote to memory of 2056 1796 9E72.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\324cf4c0528fd1a40fd13a54e6c4b1ad_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\95D7.tmp"C:\Users\Admin\AppData\Local\Temp\95D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"23⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"24⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"25⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"26⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"27⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\A299.tmp"C:\Users\Admin\AppData\Local\Temp\A299.tmp"28⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"29⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"30⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"31⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"32⤵
- Executes dropped EXE
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"33⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"34⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"35⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"36⤵
- Executes dropped EXE
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"37⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"38⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"39⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"40⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"41⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"42⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"C:\Users\Admin\AppData\Local\Temp\ABD0.tmp"43⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"44⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"45⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"46⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"47⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"48⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"49⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"50⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"51⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"52⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"53⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"54⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"55⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"56⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"57⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"58⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"59⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"60⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"61⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"62⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"63⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"64⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"65⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"66⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"67⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"68⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"69⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\BB03.tmp"C:\Users\Admin\AppData\Local\Temp\BB03.tmp"70⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"71⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"72⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"73⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"74⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"75⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"76⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"C:\Users\Admin\AppData\Local\Temp\BE6E.tmp"77⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"78⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"79⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"80⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"81⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"82⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"83⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"84⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"85⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"86⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"87⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"88⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"89⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"90⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"91⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"92⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"93⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"94⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"95⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"96⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"97⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"98⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"99⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"100⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"101⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"102⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"103⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"104⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"105⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"106⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CC97.tmp"C:\Users\Admin\AppData\Local\Temp\CC97.tmp"107⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\CD04.tmp"C:\Users\Admin\AppData\Local\Temp\CD04.tmp"108⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"109⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"C:\Users\Admin\AppData\Local\Temp\CE2D.tmp"110⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"111⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"112⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"113⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"114⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"115⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\D11B.tmp"C:\Users\Admin\AppData\Local\Temp\D11B.tmp"116⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"117⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\D215.tmp"C:\Users\Admin\AppData\Local\Temp\D215.tmp"118⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"119⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"120⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"121⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"122⤵PID:3888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-