Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe
-
Size
487KB
-
MD5
3eeae1c36ff9720e684c56a7d3424a8e
-
SHA1
648e5a5a720704df7ccfe2442c429382ef6731b0
-
SHA256
a8f967ec011d6fdee688ed33996fbf4e84bb3bf9a0161e420bfe5bbd71068949
-
SHA512
fc147dee3d170e1567df6407692835fdcb8802cce54686f079f9172521e76041d751cc247be9b448f6e57b684c0ffbf1e450da2f952dee0de2f6176bfbe4a9e1
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUdJKKVxjE6GULw9zHv/qftShOp3lmdgKxsH3j:HU5rCOTeiJRU46GUkVHHGtSAZKWNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4388 80E8.tmp 2248 81A3.tmp 4720 826E.tmp 4240 8359.tmp 1452 83F5.tmp 4212 84B1.tmp 2392 85D9.tmp 3552 8656.tmp 1692 8722.tmp 3060 87AE.tmp 4404 886A.tmp 3732 8935.tmp 2376 8A5E.tmp 648 8B29.tmp 232 8C13.tmp 2464 8CBF.tmp 4136 8D4C.tmp 1032 8E26.tmp 5096 8ED2.tmp 3368 8FAD.tmp 4344 9059.tmp 1328 9124.tmp 4052 91E0.tmp 1324 926C.tmp 4132 9318.tmp 4836 93C4.tmp 4604 948F.tmp 4000 951C.tmp 4784 9625.tmp 4628 9700.tmp 4192 97AC.tmp 4684 9848.tmp 2204 98F4.tmp 4492 9981.tmp 3376 99FE.tmp 208 9AAA.tmp 2400 9B36.tmp 4964 9BE2.tmp 3992 9C7E.tmp 2956 9D0B.tmp 2820 9D88.tmp 3736 9E24.tmp 3700 9EB1.tmp 2836 9F5D.tmp 5076 A086.tmp 2876 A112.tmp 4476 A18F.tmp 2808 A20C.tmp 3832 A2B8.tmp 1904 A345.tmp 936 A3E1.tmp 1344 A46E.tmp 3552 A4FA.tmp 228 A577.tmp 4616 A5F4.tmp 3020 A6B0.tmp 4356 A75C.tmp 3632 A7D9.tmp 1776 A865.tmp 4300 A8F2.tmp 4588 A96F.tmp 632 A9DC.tmp 2292 AA78.tmp 2912 AB24.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4388 2056 3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe 81 PID 2056 wrote to memory of 4388 2056 3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe 81 PID 2056 wrote to memory of 4388 2056 3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe 81 PID 4388 wrote to memory of 2248 4388 80E8.tmp 82 PID 4388 wrote to memory of 2248 4388 80E8.tmp 82 PID 4388 wrote to memory of 2248 4388 80E8.tmp 82 PID 2248 wrote to memory of 4720 2248 81A3.tmp 83 PID 2248 wrote to memory of 4720 2248 81A3.tmp 83 PID 2248 wrote to memory of 4720 2248 81A3.tmp 83 PID 4720 wrote to memory of 4240 4720 826E.tmp 84 PID 4720 wrote to memory of 4240 4720 826E.tmp 84 PID 4720 wrote to memory of 4240 4720 826E.tmp 84 PID 4240 wrote to memory of 1452 4240 8359.tmp 85 PID 4240 wrote to memory of 1452 4240 8359.tmp 85 PID 4240 wrote to memory of 1452 4240 8359.tmp 85 PID 1452 wrote to memory of 4212 1452 83F5.tmp 86 PID 1452 wrote to memory of 4212 1452 83F5.tmp 86 PID 1452 wrote to memory of 4212 1452 83F5.tmp 86 PID 4212 wrote to memory of 2392 4212 84B1.tmp 87 PID 4212 wrote to memory of 2392 4212 84B1.tmp 87 PID 4212 wrote to memory of 2392 4212 84B1.tmp 87 PID 2392 wrote to memory of 3552 2392 85D9.tmp 88 PID 2392 wrote to memory of 3552 2392 85D9.tmp 88 PID 2392 wrote to memory of 3552 2392 85D9.tmp 88 PID 3552 wrote to memory of 1692 3552 8656.tmp 89 PID 3552 wrote to memory of 1692 3552 8656.tmp 89 PID 3552 wrote to memory of 1692 3552 8656.tmp 89 PID 1692 wrote to memory of 3060 1692 8722.tmp 90 PID 1692 wrote to memory of 3060 1692 8722.tmp 90 PID 1692 wrote to memory of 3060 1692 8722.tmp 90 PID 3060 wrote to memory of 4404 3060 87AE.tmp 91 PID 3060 wrote to memory of 4404 3060 87AE.tmp 91 PID 3060 wrote to memory of 4404 3060 87AE.tmp 91 PID 4404 wrote to memory of 3732 4404 886A.tmp 92 PID 4404 wrote to memory of 3732 4404 886A.tmp 92 PID 4404 wrote to memory of 3732 4404 886A.tmp 92 PID 3732 wrote to memory of 2376 3732 8935.tmp 93 PID 3732 wrote to memory of 2376 3732 8935.tmp 93 PID 3732 wrote to memory of 2376 3732 8935.tmp 93 PID 2376 wrote to memory of 648 2376 8A5E.tmp 94 PID 2376 wrote to memory of 648 2376 8A5E.tmp 94 PID 2376 wrote to memory of 648 2376 8A5E.tmp 94 PID 648 wrote to memory of 232 648 8B29.tmp 97 PID 648 wrote to memory of 232 648 8B29.tmp 97 PID 648 wrote to memory of 232 648 8B29.tmp 97 PID 232 wrote to memory of 2464 232 8C13.tmp 98 PID 232 wrote to memory of 2464 232 8C13.tmp 98 PID 232 wrote to memory of 2464 232 8C13.tmp 98 PID 2464 wrote to memory of 4136 2464 8CBF.tmp 99 PID 2464 wrote to memory of 4136 2464 8CBF.tmp 99 PID 2464 wrote to memory of 4136 2464 8CBF.tmp 99 PID 4136 wrote to memory of 1032 4136 8D4C.tmp 100 PID 4136 wrote to memory of 1032 4136 8D4C.tmp 100 PID 4136 wrote to memory of 1032 4136 8D4C.tmp 100 PID 1032 wrote to memory of 5096 1032 8E26.tmp 101 PID 1032 wrote to memory of 5096 1032 8E26.tmp 101 PID 1032 wrote to memory of 5096 1032 8E26.tmp 101 PID 5096 wrote to memory of 3368 5096 8ED2.tmp 102 PID 5096 wrote to memory of 3368 5096 8ED2.tmp 102 PID 5096 wrote to memory of 3368 5096 8ED2.tmp 102 PID 3368 wrote to memory of 4344 3368 8FAD.tmp 104 PID 3368 wrote to memory of 4344 3368 8FAD.tmp 104 PID 3368 wrote to memory of 4344 3368 8FAD.tmp 104 PID 4344 wrote to memory of 1328 4344 9059.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\3eeae1c36ff9720e684c56a7d3424a8e_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8722.tmp"C:\Users\Admin\AppData\Local\Temp\8722.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8B29.tmp"C:\Users\Admin\AppData\Local\Temp\8B29.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"23⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"24⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"25⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"26⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"27⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"28⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"29⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"30⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"31⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"32⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"33⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"34⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"35⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"36⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"37⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"38⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"39⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"40⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"41⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"42⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"43⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"44⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"45⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"46⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"47⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"48⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"49⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"50⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"51⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"C:\Users\Admin\AppData\Local\Temp\A3E1.tmp"52⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"53⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"54⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"55⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"56⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"57⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"58⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"59⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"60⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"61⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"62⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"63⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"64⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"65⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"66⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"C:\Users\Admin\AppData\Local\Temp\AC4D.tmp"67⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"68⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"69⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"70⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"71⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"72⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"73⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"74⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"75⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"C:\Users\Admin\AppData\Local\Temp\B1DB.tmp"76⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"77⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B342.tmp"C:\Users\Admin\AppData\Local\Temp\B342.tmp"78⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"79⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"80⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"81⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\B585.tmp"C:\Users\Admin\AppData\Local\Temp\B585.tmp"82⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"83⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"84⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"85⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"86⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"87⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"88⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"89⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"90⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"91⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"92⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"93⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"94⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"95⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\BD16.tmp"C:\Users\Admin\AppData\Local\Temp\BD16.tmp"96⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"97⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"98⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"C:\Users\Admin\AppData\Local\Temp\BE9D.tmp"99⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"100⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"101⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"102⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"103⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"104⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"105⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\C256.tmp"C:\Users\Admin\AppData\Local\Temp\C256.tmp"106⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"107⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\C350.tmp"C:\Users\Admin\AppData\Local\Temp\C350.tmp"108⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"109⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"110⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"112⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"113⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"114⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"115⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"116⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"117⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"118⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"119⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"120⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"121⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"122⤵PID:4408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-