Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 15:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe
-
Size
487KB
-
MD5
47e7cfe1e3a119a681c941648d7a501d
-
SHA1
97589aa1b7d66589356a83710456dd5ad3cce941
-
SHA256
17abfef5de202c6ccfa87d7df2d333660e021e48b5ab9411ba2e65e86ee82775
-
SHA512
b929b4b38e03816401af7eb21e9e4de60b7a6145323ec95fbfc27e7db6c1caa6f53f5bb4dd31d17974cd8e228f053db15f12b98d1625a56bf6ee489f08fc0541
-
SSDEEP
12288:yU5rCOTeiNK7V9FYI0F9HtgJn/XdoGmfPbZ:yUQOJNK7VoIq2V/X5mXb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4728 B083.tmp 3672 B14E.tmp 3940 B20A.tmp 2764 B2E5.tmp 4048 B362.tmp 4668 B41D.tmp 4088 B4C9.tmp 964 B5A4.tmp 4520 B66F.tmp 3572 B71B.tmp 4344 B7E6.tmp 4740 B882.tmp 3868 B90F.tmp 852 BAB5.tmp 3360 BB61.tmp 3124 BC4B.tmp 864 BD45.tmp 2564 BE10.tmp 3060 BEBC.tmp 1888 BF77.tmp 3912 C004.tmp 3632 C0C0.tmp 1108 C17B.tmp 2504 C208.tmp 424 C2A4.tmp 972 C39E.tmp 2728 C459.tmp 4340 C525.tmp 4024 C5C1.tmp 3956 C65D.tmp 2984 C728.tmp 4932 C7C4.tmp 2572 C841.tmp 1120 C8AF.tmp 5040 C92C.tmp 1948 C9B8.tmp 1472 CA74.tmp 2964 CB10.tmp 1460 CB8D.tmp 2776 CC0A.tmp 1876 CCB6.tmp 3064 CD33.tmp 700 CDB0.tmp 1784 CE3D.tmp 5000 CEE9.tmp 5112 CF56.tmp 2516 CFD3.tmp 544 D050.tmp 1296 D0EC.tmp 4840 D169.tmp 2892 D1D7.tmp 4680 D263.tmp 228 D30F.tmp 2444 D39C.tmp 2864 D419.tmp 4712 D4C5.tmp 1452 D551.tmp 4588 D5ED.tmp 4044 D699.tmp 3940 D716.tmp 4052 D7B3.tmp 4936 D85E.tmp 1628 D8EB.tmp 3860 D968.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4728 4672 47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe 82 PID 4672 wrote to memory of 4728 4672 47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe 82 PID 4672 wrote to memory of 4728 4672 47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe 82 PID 4728 wrote to memory of 3672 4728 B083.tmp 83 PID 4728 wrote to memory of 3672 4728 B083.tmp 83 PID 4728 wrote to memory of 3672 4728 B083.tmp 83 PID 3672 wrote to memory of 3940 3672 B14E.tmp 84 PID 3672 wrote to memory of 3940 3672 B14E.tmp 84 PID 3672 wrote to memory of 3940 3672 B14E.tmp 84 PID 3940 wrote to memory of 2764 3940 B20A.tmp 85 PID 3940 wrote to memory of 2764 3940 B20A.tmp 85 PID 3940 wrote to memory of 2764 3940 B20A.tmp 85 PID 2764 wrote to memory of 4048 2764 B2E5.tmp 86 PID 2764 wrote to memory of 4048 2764 B2E5.tmp 86 PID 2764 wrote to memory of 4048 2764 B2E5.tmp 86 PID 4048 wrote to memory of 4668 4048 B362.tmp 87 PID 4048 wrote to memory of 4668 4048 B362.tmp 87 PID 4048 wrote to memory of 4668 4048 B362.tmp 87 PID 4668 wrote to memory of 4088 4668 B41D.tmp 88 PID 4668 wrote to memory of 4088 4668 B41D.tmp 88 PID 4668 wrote to memory of 4088 4668 B41D.tmp 88 PID 4088 wrote to memory of 964 4088 B4C9.tmp 89 PID 4088 wrote to memory of 964 4088 B4C9.tmp 89 PID 4088 wrote to memory of 964 4088 B4C9.tmp 89 PID 964 wrote to memory of 4520 964 B5A4.tmp 90 PID 964 wrote to memory of 4520 964 B5A4.tmp 90 PID 964 wrote to memory of 4520 964 B5A4.tmp 90 PID 4520 wrote to memory of 3572 4520 B66F.tmp 91 PID 4520 wrote to memory of 3572 4520 B66F.tmp 91 PID 4520 wrote to memory of 3572 4520 B66F.tmp 91 PID 3572 wrote to memory of 4344 3572 B71B.tmp 92 PID 3572 wrote to memory of 4344 3572 B71B.tmp 92 PID 3572 wrote to memory of 4344 3572 B71B.tmp 92 PID 4344 wrote to memory of 4740 4344 B7E6.tmp 93 PID 4344 wrote to memory of 4740 4344 B7E6.tmp 93 PID 4344 wrote to memory of 4740 4344 B7E6.tmp 93 PID 4740 wrote to memory of 3868 4740 B882.tmp 94 PID 4740 wrote to memory of 3868 4740 B882.tmp 94 PID 4740 wrote to memory of 3868 4740 B882.tmp 94 PID 3868 wrote to memory of 852 3868 B90F.tmp 95 PID 3868 wrote to memory of 852 3868 B90F.tmp 95 PID 3868 wrote to memory of 852 3868 B90F.tmp 95 PID 852 wrote to memory of 3360 852 BAB5.tmp 96 PID 852 wrote to memory of 3360 852 BAB5.tmp 96 PID 852 wrote to memory of 3360 852 BAB5.tmp 96 PID 3360 wrote to memory of 3124 3360 BB61.tmp 97 PID 3360 wrote to memory of 3124 3360 BB61.tmp 97 PID 3360 wrote to memory of 3124 3360 BB61.tmp 97 PID 3124 wrote to memory of 864 3124 BC4B.tmp 98 PID 3124 wrote to memory of 864 3124 BC4B.tmp 98 PID 3124 wrote to memory of 864 3124 BC4B.tmp 98 PID 864 wrote to memory of 2564 864 BD45.tmp 99 PID 864 wrote to memory of 2564 864 BD45.tmp 99 PID 864 wrote to memory of 2564 864 BD45.tmp 99 PID 2564 wrote to memory of 3060 2564 BE10.tmp 100 PID 2564 wrote to memory of 3060 2564 BE10.tmp 100 PID 2564 wrote to memory of 3060 2564 BE10.tmp 100 PID 3060 wrote to memory of 1888 3060 BEBC.tmp 101 PID 3060 wrote to memory of 1888 3060 BEBC.tmp 101 PID 3060 wrote to memory of 1888 3060 BEBC.tmp 101 PID 1888 wrote to memory of 3912 1888 BF77.tmp 102 PID 1888 wrote to memory of 3912 1888 BF77.tmp 102 PID 1888 wrote to memory of 3912 1888 BF77.tmp 102 PID 3912 wrote to memory of 3632 3912 C004.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\47e7cfe1e3a119a681c941648d7a501d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\B882.tmp"C:\Users\Admin\AppData\Local\Temp\B882.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\B90F.tmp"C:\Users\Admin\AppData\Local\Temp\B90F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"23⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"24⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"25⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"26⤵
- Executes dropped EXE
PID:424 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"27⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"28⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"29⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"30⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"31⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"32⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"33⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"34⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"35⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\C92C.tmp"C:\Users\Admin\AppData\Local\Temp\C92C.tmp"36⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"C:\Users\Admin\AppData\Local\Temp\C9B8.tmp"37⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"38⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"39⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"40⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"C:\Users\Admin\AppData\Local\Temp\CC0A.tmp"41⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"42⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"43⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"44⤵
- Executes dropped EXE
PID:700 -
C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"C:\Users\Admin\AppData\Local\Temp\CE3D.tmp"45⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"46⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"47⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"48⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"49⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"50⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\D169.tmp"C:\Users\Admin\AppData\Local\Temp\D169.tmp"51⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"52⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\D263.tmp"C:\Users\Admin\AppData\Local\Temp\D263.tmp"53⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"54⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"55⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"56⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"57⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"58⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"59⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"60⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"61⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"62⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"63⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"C:\Users\Admin\AppData\Local\Temp\D8EB.tmp"64⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"65⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"66⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"67⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"C:\Users\Admin\AppData\Local\Temp\DB6C.tmp"68⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"69⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"70⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"71⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"72⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"73⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"74⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"75⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"76⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"C:\Users\Admin\AppData\Local\Temp\DFE0.tmp"77⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"78⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"79⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"80⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"81⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"82⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\E30D.tmp"C:\Users\Admin\AppData\Local\Temp\E30D.tmp"83⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"84⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"85⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"86⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"87⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"88⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"89⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"90⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"91⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"92⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"93⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"94⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"95⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"96⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"97⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\EACD.tmp"C:\Users\Admin\AppData\Local\Temp\EACD.tmp"98⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"99⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"100⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"101⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"102⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"C:\Users\Admin\AppData\Local\Temp\ED6D.tmp"103⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"104⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\EE77.tmp"C:\Users\Admin\AppData\Local\Temp\EE77.tmp"105⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"106⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"107⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"108⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"109⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"110⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"C:\Users\Admin\AppData\Local\Temp\F1A3.tmp"111⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"112⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"C:\Users\Admin\AppData\Local\Temp\F2BC.tmp"113⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"114⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"115⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"117⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"118⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"119⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\F676.tmp"C:\Users\Admin\AppData\Local\Temp\F676.tmp"120⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"121⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-