Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe
-
Size
488KB
-
MD5
842a81fa694faaf4397f5be8833e1fdf
-
SHA1
30a99597317e87ccb1127012f3ce263b5fc3cdc5
-
SHA256
d8f5171b25fde4be5d5a66c5891dd4463a9a1f01147d69286e2f8d473e0b894c
-
SHA512
18fda77af16d131f47bba473e8be09739613f87330fc5cca9cba7251337f17ad1fd6dfdc2628a58de08c65e733d28f41bae91ae2bcd04f9a430886afcfb2d684
-
SSDEEP
12288:/U5rCOTeiDs1uOCo9ZVius1fKpfAQsMllNZ:/UQOJDkiYZVY1feYQ/fN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4528 A911.tmp 2964 A9BD.tmp 1696 AAA7.tmp 2212 ABB1.tmp 4612 AC8C.tmp 2936 AD38.tmp 4360 ADF3.tmp 4900 AEFD.tmp 3688 AFA9.tmp 4664 B026.tmp 4328 B0C2.tmp 3504 B1AC.tmp 1456 B297.tmp 464 B3B0.tmp 1252 B48B.tmp 2840 B556.tmp 4780 B602.tmp 1708 B69E.tmp 4632 B70B.tmp 3384 B7A7.tmp 1368 B8D0.tmp 3668 B99B.tmp 1544 BA47.tmp 1156 BB22.tmp 1592 BB9F.tmp 3304 BC4B.tmp 4364 BCD8.tmp 2032 BD55.tmp 4920 BDE1.tmp 3760 BF39.tmp 4180 BFF4.tmp 4540 C0CF.tmp 4388 C17B.tmp 2988 C208.tmp 760 C285.tmp 3948 C311.tmp 3724 C3DC.tmp 1828 C479.tmp 384 C525.tmp 1788 C5C1.tmp 1856 C66D.tmp 4072 C6EA.tmp 5076 C767.tmp 4600 C803.tmp 1296 C8AF.tmp 1528 C93B.tmp 3832 C9F7.tmp 844 CA84.tmp 4416 CB20.tmp 1464 CBBC.tmp 1436 CC78.tmp 968 CD14.tmp 4408 CDA0.tmp 5072 CE0E.tmp 2976 CE8B.tmp 1904 CF08.tmp 2236 CFA4.tmp 4684 D031.tmp 4828 D0AE.tmp 4168 D13A.tmp 4092 D1C7.tmp 2628 D234.tmp 4400 D2E0.tmp 4348 D36D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 4528 2236 842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe 82 PID 2236 wrote to memory of 4528 2236 842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe 82 PID 2236 wrote to memory of 4528 2236 842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe 82 PID 4528 wrote to memory of 2964 4528 A911.tmp 83 PID 4528 wrote to memory of 2964 4528 A911.tmp 83 PID 4528 wrote to memory of 2964 4528 A911.tmp 83 PID 2964 wrote to memory of 1696 2964 A9BD.tmp 84 PID 2964 wrote to memory of 1696 2964 A9BD.tmp 84 PID 2964 wrote to memory of 1696 2964 A9BD.tmp 84 PID 1696 wrote to memory of 2212 1696 AAA7.tmp 85 PID 1696 wrote to memory of 2212 1696 AAA7.tmp 85 PID 1696 wrote to memory of 2212 1696 AAA7.tmp 85 PID 2212 wrote to memory of 4612 2212 ABB1.tmp 86 PID 2212 wrote to memory of 4612 2212 ABB1.tmp 86 PID 2212 wrote to memory of 4612 2212 ABB1.tmp 86 PID 4612 wrote to memory of 2936 4612 AC8C.tmp 87 PID 4612 wrote to memory of 2936 4612 AC8C.tmp 87 PID 4612 wrote to memory of 2936 4612 AC8C.tmp 87 PID 2936 wrote to memory of 4360 2936 AD38.tmp 88 PID 2936 wrote to memory of 4360 2936 AD38.tmp 88 PID 2936 wrote to memory of 4360 2936 AD38.tmp 88 PID 4360 wrote to memory of 4900 4360 ADF3.tmp 89 PID 4360 wrote to memory of 4900 4360 ADF3.tmp 89 PID 4360 wrote to memory of 4900 4360 ADF3.tmp 89 PID 4900 wrote to memory of 3688 4900 AEFD.tmp 91 PID 4900 wrote to memory of 3688 4900 AEFD.tmp 91 PID 4900 wrote to memory of 3688 4900 AEFD.tmp 91 PID 3688 wrote to memory of 4664 3688 AFA9.tmp 92 PID 3688 wrote to memory of 4664 3688 AFA9.tmp 92 PID 3688 wrote to memory of 4664 3688 AFA9.tmp 92 PID 4664 wrote to memory of 4328 4664 B026.tmp 93 PID 4664 wrote to memory of 4328 4664 B026.tmp 93 PID 4664 wrote to memory of 4328 4664 B026.tmp 93 PID 4328 wrote to memory of 3504 4328 B0C2.tmp 94 PID 4328 wrote to memory of 3504 4328 B0C2.tmp 94 PID 4328 wrote to memory of 3504 4328 B0C2.tmp 94 PID 3504 wrote to memory of 1456 3504 B1AC.tmp 95 PID 3504 wrote to memory of 1456 3504 B1AC.tmp 95 PID 3504 wrote to memory of 1456 3504 B1AC.tmp 95 PID 1456 wrote to memory of 464 1456 B297.tmp 96 PID 1456 wrote to memory of 464 1456 B297.tmp 96 PID 1456 wrote to memory of 464 1456 B297.tmp 96 PID 464 wrote to memory of 1252 464 B3B0.tmp 97 PID 464 wrote to memory of 1252 464 B3B0.tmp 97 PID 464 wrote to memory of 1252 464 B3B0.tmp 97 PID 1252 wrote to memory of 2840 1252 B48B.tmp 98 PID 1252 wrote to memory of 2840 1252 B48B.tmp 98 PID 1252 wrote to memory of 2840 1252 B48B.tmp 98 PID 2840 wrote to memory of 4780 2840 B556.tmp 99 PID 2840 wrote to memory of 4780 2840 B556.tmp 99 PID 2840 wrote to memory of 4780 2840 B556.tmp 99 PID 4780 wrote to memory of 1708 4780 B602.tmp 100 PID 4780 wrote to memory of 1708 4780 B602.tmp 100 PID 4780 wrote to memory of 1708 4780 B602.tmp 100 PID 1708 wrote to memory of 4632 1708 B69E.tmp 103 PID 1708 wrote to memory of 4632 1708 B69E.tmp 103 PID 1708 wrote to memory of 4632 1708 B69E.tmp 103 PID 4632 wrote to memory of 3384 4632 B70B.tmp 104 PID 4632 wrote to memory of 3384 4632 B70B.tmp 104 PID 4632 wrote to memory of 3384 4632 B70B.tmp 104 PID 3384 wrote to memory of 1368 3384 B7A7.tmp 105 PID 3384 wrote to memory of 1368 3384 B7A7.tmp 105 PID 3384 wrote to memory of 1368 3384 B7A7.tmp 105 PID 1368 wrote to memory of 3668 1368 B8D0.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\842a81fa694faaf4397f5be8833e1fdf_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\AD38.tmp"C:\Users\Admin\AppData\Local\Temp\AD38.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"23⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"24⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"25⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"26⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"27⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"28⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"29⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"30⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"31⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"32⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"33⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"34⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\C208.tmp"C:\Users\Admin\AppData\Local\Temp\C208.tmp"35⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\C285.tmp"C:\Users\Admin\AppData\Local\Temp\C285.tmp"36⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"37⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"38⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"39⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"40⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"41⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\C66D.tmp"C:\Users\Admin\AppData\Local\Temp\C66D.tmp"42⤵
- Executes dropped EXE
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"C:\Users\Admin\AppData\Local\Temp\C6EA.tmp"43⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"44⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"45⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"46⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"47⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"C:\Users\Admin\AppData\Local\Temp\C9F7.tmp"48⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"49⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\CB20.tmp"C:\Users\Admin\AppData\Local\Temp\CB20.tmp"50⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"51⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"52⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"53⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"C:\Users\Admin\AppData\Local\Temp\CDA0.tmp"54⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"55⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"C:\Users\Admin\AppData\Local\Temp\CE8B.tmp"56⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"57⤵
- Executes dropped EXE
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"C:\Users\Admin\AppData\Local\Temp\CFA4.tmp"58⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"59⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"60⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"61⤵
- Executes dropped EXE
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"C:\Users\Admin\AppData\Local\Temp\D1C7.tmp"62⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"63⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"64⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\D36D.tmp"C:\Users\Admin\AppData\Local\Temp\D36D.tmp"65⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"C:\Users\Admin\AppData\Local\Temp\D3DA.tmp"66⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"67⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"68⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\D522.tmp"C:\Users\Admin\AppData\Local\Temp\D522.tmp"69⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"70⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"71⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"C:\Users\Admin\AppData\Local\Temp\D6A9.tmp"72⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\D736.tmp"C:\Users\Admin\AppData\Local\Temp\D736.tmp"73⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"C:\Users\Admin\AppData\Local\Temp\D7C2.tmp"74⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\D85E.tmp"C:\Users\Admin\AppData\Local\Temp\D85E.tmp"75⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"76⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"77⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"78⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"79⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"80⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"81⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"C:\Users\Admin\AppData\Local\Temp\DB9B.tmp"82⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"83⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"84⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"85⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"86⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"87⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"88⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"89⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"90⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"91⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"92⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"93⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"94⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"95⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"96⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"97⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"98⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"99⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E54F.tmp"C:\Users\Admin\AppData\Local\Temp\E54F.tmp"100⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"101⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"102⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"103⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"104⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"105⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"106⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"107⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"108⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"109⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"110⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"111⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"112⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\EC35.tmp"C:\Users\Admin\AppData\Local\Temp\EC35.tmp"113⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"114⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"115⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"116⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"117⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"118⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\EF51.tmp"C:\Users\Admin\AppData\Local\Temp\EF51.tmp"119⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"120⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"121⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-