Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe
-
Size
486KB
-
MD5
8e7719bf42da60cb1a5ad24fa6b2b414
-
SHA1
bb34830545b29eb1d5f10098732643516a7226e4
-
SHA256
585e7eaf980c9c22015667d02649dca7a6e35a6e0aea10917d326924caf08c08
-
SHA512
67dbcbc81529e02907dbaf94a29847cb6b9ce37e4b8590459abf7eb7946fb4c7da06d22154be92b542f8e133778e4e9db70fac6e27c21788828e0656b1fe84f6
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD7QFCorJ3sEhlp8dMwwzNLn8GiTR5RkZ7uv/la:oU5rCOTeiDS93sWzMMwwBC9507k6NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2240 7A8F.tmp 764 7B79.tmp 928 7C06.tmp 2312 7CD1.tmp 4388 7D6D.tmp 4248 7E19.tmp 1132 7F03.tmp 4592 7FFD.tmp 3328 806B.tmp 3676 8117.tmp 1200 81B3.tmp 4724 828E.tmp 4756 833A.tmp 4004 83F5.tmp 3068 855C.tmp 4032 85E9.tmp 1628 86D3.tmp 4864 87AE.tmp 568 8879.tmp 564 8935.tmp 4500 8A1F.tmp 1360 8B0A.tmp 2504 8BB5.tmp 540 8C61.tmp 3108 8CFE.tmp 3948 8DC9.tmp 1924 8EA3.tmp 4180 8F30.tmp 1760 8FDC.tmp 4288 9088.tmp 2652 9153.tmp 4700 923D.tmp 4120 9318.tmp 3204 9395.tmp 1752 9431.tmp 3364 94DD.tmp 3816 9579.tmp 2236 9616.tmp 4896 96B2.tmp 3828 971F.tmp 4352 979C.tmp 4412 9819.tmp 2384 9896.tmp 3952 9923.tmp 4548 9990.tmp 4392 9A1D.tmp 4912 9A7B.tmp 4540 9AC9.tmp 2428 9B36.tmp 5028 9BB3.tmp 3756 9C4F.tmp 3444 9CEC.tmp 3100 9DF5.tmp 4164 9E82.tmp 4620 9EFF.tmp 1484 9F7C.tmp 3500 9FE9.tmp 3028 A057.tmp 5060 A0C4.tmp 3840 A141.tmp 2160 A1DD.tmp 816 A27A.tmp 3096 A306.tmp 2768 A383.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2240 1484 8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe 81 PID 1484 wrote to memory of 2240 1484 8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe 81 PID 1484 wrote to memory of 2240 1484 8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe 81 PID 2240 wrote to memory of 764 2240 7A8F.tmp 82 PID 2240 wrote to memory of 764 2240 7A8F.tmp 82 PID 2240 wrote to memory of 764 2240 7A8F.tmp 82 PID 764 wrote to memory of 928 764 7B79.tmp 83 PID 764 wrote to memory of 928 764 7B79.tmp 83 PID 764 wrote to memory of 928 764 7B79.tmp 83 PID 928 wrote to memory of 2312 928 7C06.tmp 84 PID 928 wrote to memory of 2312 928 7C06.tmp 84 PID 928 wrote to memory of 2312 928 7C06.tmp 84 PID 2312 wrote to memory of 4388 2312 7CD1.tmp 85 PID 2312 wrote to memory of 4388 2312 7CD1.tmp 85 PID 2312 wrote to memory of 4388 2312 7CD1.tmp 85 PID 4388 wrote to memory of 4248 4388 7D6D.tmp 86 PID 4388 wrote to memory of 4248 4388 7D6D.tmp 86 PID 4388 wrote to memory of 4248 4388 7D6D.tmp 86 PID 4248 wrote to memory of 1132 4248 7E19.tmp 87 PID 4248 wrote to memory of 1132 4248 7E19.tmp 87 PID 4248 wrote to memory of 1132 4248 7E19.tmp 87 PID 1132 wrote to memory of 4592 1132 7F03.tmp 88 PID 1132 wrote to memory of 4592 1132 7F03.tmp 88 PID 1132 wrote to memory of 4592 1132 7F03.tmp 88 PID 4592 wrote to memory of 3328 4592 7FFD.tmp 89 PID 4592 wrote to memory of 3328 4592 7FFD.tmp 89 PID 4592 wrote to memory of 3328 4592 7FFD.tmp 89 PID 3328 wrote to memory of 3676 3328 806B.tmp 91 PID 3328 wrote to memory of 3676 3328 806B.tmp 91 PID 3328 wrote to memory of 3676 3328 806B.tmp 91 PID 3676 wrote to memory of 1200 3676 8117.tmp 92 PID 3676 wrote to memory of 1200 3676 8117.tmp 92 PID 3676 wrote to memory of 1200 3676 8117.tmp 92 PID 1200 wrote to memory of 4724 1200 81B3.tmp 93 PID 1200 wrote to memory of 4724 1200 81B3.tmp 93 PID 1200 wrote to memory of 4724 1200 81B3.tmp 93 PID 4724 wrote to memory of 4756 4724 828E.tmp 94 PID 4724 wrote to memory of 4756 4724 828E.tmp 94 PID 4724 wrote to memory of 4756 4724 828E.tmp 94 PID 4756 wrote to memory of 4004 4756 833A.tmp 95 PID 4756 wrote to memory of 4004 4756 833A.tmp 95 PID 4756 wrote to memory of 4004 4756 833A.tmp 95 PID 4004 wrote to memory of 3068 4004 83F5.tmp 96 PID 4004 wrote to memory of 3068 4004 83F5.tmp 96 PID 4004 wrote to memory of 3068 4004 83F5.tmp 96 PID 3068 wrote to memory of 4032 3068 855C.tmp 97 PID 3068 wrote to memory of 4032 3068 855C.tmp 97 PID 3068 wrote to memory of 4032 3068 855C.tmp 97 PID 4032 wrote to memory of 1628 4032 85E9.tmp 98 PID 4032 wrote to memory of 1628 4032 85E9.tmp 98 PID 4032 wrote to memory of 1628 4032 85E9.tmp 98 PID 1628 wrote to memory of 4864 1628 86D3.tmp 99 PID 1628 wrote to memory of 4864 1628 86D3.tmp 99 PID 1628 wrote to memory of 4864 1628 86D3.tmp 99 PID 4864 wrote to memory of 568 4864 87AE.tmp 100 PID 4864 wrote to memory of 568 4864 87AE.tmp 100 PID 4864 wrote to memory of 568 4864 87AE.tmp 100 PID 568 wrote to memory of 564 568 8879.tmp 101 PID 568 wrote to memory of 564 568 8879.tmp 101 PID 568 wrote to memory of 564 568 8879.tmp 101 PID 564 wrote to memory of 4500 564 8935.tmp 102 PID 564 wrote to memory of 4500 564 8935.tmp 102 PID 564 wrote to memory of 4500 564 8935.tmp 102 PID 4500 wrote to memory of 1360 4500 8A1F.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\8e7719bf42da60cb1a5ad24fa6b2b414_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"23⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"24⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"25⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"26⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"27⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"28⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"29⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"30⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"31⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"32⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"33⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9318.tmp"C:\Users\Admin\AppData\Local\Temp\9318.tmp"34⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"35⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"36⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"37⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"38⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"39⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"40⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"41⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"42⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"43⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"44⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"45⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"46⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"47⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"48⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"49⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"50⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"51⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"52⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"53⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"54⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"55⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"56⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"57⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"58⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\A057.tmp"C:\Users\Admin\AppData\Local\Temp\A057.tmp"59⤵
- Executes dropped EXE
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"60⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"61⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"62⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\A27A.tmp"C:\Users\Admin\AppData\Local\Temp\A27A.tmp"63⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"64⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"65⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"66⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"67⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"68⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"69⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"70⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"71⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"72⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"73⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"74⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"C:\Users\Admin\AppData\Local\Temp\A8D3.tmp"75⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"76⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"77⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"78⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"79⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"80⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"81⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"82⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"83⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"84⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\AE12.tmp"C:\Users\Admin\AppData\Local\Temp\AE12.tmp"85⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"86⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"87⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"88⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"89⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"90⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\B17D.tmp"C:\Users\Admin\AppData\Local\Temp\B17D.tmp"91⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"92⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"93⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"94⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"95⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"C:\Users\Admin\AppData\Local\Temp\B3FE.tmp"96⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"97⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"98⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"C:\Users\Admin\AppData\Local\Temp\B5B3.tmp"99⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"100⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"101⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"102⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"103⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"104⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"105⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"106⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"107⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"108⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"109⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"110⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"111⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"112⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"C:\Users\Admin\AppData\Local\Temp\BC2C.tmp"113⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"114⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"115⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"116⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"117⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"118⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"119⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"120⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"121⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-