Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe
-
Size
487KB
-
MD5
eaf02bce5abee0d8bd98ed736e6fdcee
-
SHA1
c48a6f97a4ba9f2c25713d8eb9f1064c4ec11903
-
SHA256
ebf1c5c6f9325c2965c3bbbaca37f42a59b3379243b293dd69eb72b0392aa371
-
SHA512
9bbcca5c0c5dd07940097c5b56bfc744222dd2edf5edf90e57306c285528f28e5388f4be8100470cb4f3d929e801825fa6bb6f79cbf5608499db9c38df606d0f
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUelKrO6bykQb+basz4NvssolJD4IqCbveU097:HU5rCOTeiJCiuyiz4NcvveU2VJNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4720 B8E0.tmp 2556 B9AB.tmp 2436 C0A0.tmp 1648 C18B.tmp 1128 C237.tmp 3444 C321.tmp 2184 C3CD.tmp 2780 C4A8.tmp 4740 C553.tmp 4912 C62E.tmp 268 C719.tmp 984 C7F3.tmp 1484 C8AF.tmp 820 C98A.tmp 2336 CA45.tmp 1332 CAE1.tmp 3372 CBDB.tmp 4684 CCD5.tmp 3864 CD72.tmp 4148 CE5C.tmp 3280 CF27.tmp 232 D011.tmp 4560 D13A.tmp 3016 D225.tmp 1188 D33E.tmp 4084 D419.tmp 1924 D4F3.tmp 2720 D5DE.tmp 3756 D68A.tmp 980 D784.tmp 4728 D86E.tmp 420 D90A.tmp 996 DA04.tmp 2868 DAA1.tmp 1384 DB5C.tmp 1360 DC08.tmp 4752 DC95.tmp 1364 DD50.tmp 4200 DDEC.tmp 2020 DE98.tmp 1084 DF25.tmp 2180 DFC1.tmp 2828 E07D.tmp 2052 E138.tmp 2568 E213.tmp 1796 E2BF.tmp 1452 E36B.tmp 2420 E407.tmp 5052 E484.tmp 3548 E510.tmp 3432 E5AD.tmp 3616 E649.tmp 4620 E6F5.tmp 1320 E7A1.tmp 1476 E85C.tmp 492 E908.tmp 2580 E995.tmp 1264 EA02.tmp 4900 EAAE.tmp 1592 EB2B.tmp 3200 EBA8.tmp 4808 EC63.tmp 560 ECF0.tmp 756 ED8C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4720 4692 2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe 83 PID 4692 wrote to memory of 4720 4692 2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe 83 PID 4692 wrote to memory of 4720 4692 2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe 83 PID 4720 wrote to memory of 2556 4720 B8E0.tmp 84 PID 4720 wrote to memory of 2556 4720 B8E0.tmp 84 PID 4720 wrote to memory of 2556 4720 B8E0.tmp 84 PID 2556 wrote to memory of 2436 2556 B9AB.tmp 85 PID 2556 wrote to memory of 2436 2556 B9AB.tmp 85 PID 2556 wrote to memory of 2436 2556 B9AB.tmp 85 PID 2436 wrote to memory of 1648 2436 C0A0.tmp 86 PID 2436 wrote to memory of 1648 2436 C0A0.tmp 86 PID 2436 wrote to memory of 1648 2436 C0A0.tmp 86 PID 1648 wrote to memory of 1128 1648 C18B.tmp 87 PID 1648 wrote to memory of 1128 1648 C18B.tmp 87 PID 1648 wrote to memory of 1128 1648 C18B.tmp 87 PID 1128 wrote to memory of 3444 1128 C237.tmp 88 PID 1128 wrote to memory of 3444 1128 C237.tmp 88 PID 1128 wrote to memory of 3444 1128 C237.tmp 88 PID 3444 wrote to memory of 2184 3444 C321.tmp 89 PID 3444 wrote to memory of 2184 3444 C321.tmp 89 PID 3444 wrote to memory of 2184 3444 C321.tmp 89 PID 2184 wrote to memory of 2780 2184 C3CD.tmp 90 PID 2184 wrote to memory of 2780 2184 C3CD.tmp 90 PID 2184 wrote to memory of 2780 2184 C3CD.tmp 90 PID 2780 wrote to memory of 4740 2780 C4A8.tmp 91 PID 2780 wrote to memory of 4740 2780 C4A8.tmp 91 PID 2780 wrote to memory of 4740 2780 C4A8.tmp 91 PID 4740 wrote to memory of 4912 4740 C553.tmp 92 PID 4740 wrote to memory of 4912 4740 C553.tmp 92 PID 4740 wrote to memory of 4912 4740 C553.tmp 92 PID 4912 wrote to memory of 268 4912 C62E.tmp 93 PID 4912 wrote to memory of 268 4912 C62E.tmp 93 PID 4912 wrote to memory of 268 4912 C62E.tmp 93 PID 268 wrote to memory of 984 268 C719.tmp 94 PID 268 wrote to memory of 984 268 C719.tmp 94 PID 268 wrote to memory of 984 268 C719.tmp 94 PID 984 wrote to memory of 1484 984 C7F3.tmp 95 PID 984 wrote to memory of 1484 984 C7F3.tmp 95 PID 984 wrote to memory of 1484 984 C7F3.tmp 95 PID 1484 wrote to memory of 820 1484 C8AF.tmp 96 PID 1484 wrote to memory of 820 1484 C8AF.tmp 96 PID 1484 wrote to memory of 820 1484 C8AF.tmp 96 PID 820 wrote to memory of 2336 820 C98A.tmp 97 PID 820 wrote to memory of 2336 820 C98A.tmp 97 PID 820 wrote to memory of 2336 820 C98A.tmp 97 PID 2336 wrote to memory of 1332 2336 CA45.tmp 98 PID 2336 wrote to memory of 1332 2336 CA45.tmp 98 PID 2336 wrote to memory of 1332 2336 CA45.tmp 98 PID 1332 wrote to memory of 3372 1332 CAE1.tmp 99 PID 1332 wrote to memory of 3372 1332 CAE1.tmp 99 PID 1332 wrote to memory of 3372 1332 CAE1.tmp 99 PID 3372 wrote to memory of 4684 3372 CBDB.tmp 100 PID 3372 wrote to memory of 4684 3372 CBDB.tmp 100 PID 3372 wrote to memory of 4684 3372 CBDB.tmp 100 PID 4684 wrote to memory of 3864 4684 CCD5.tmp 101 PID 4684 wrote to memory of 3864 4684 CCD5.tmp 101 PID 4684 wrote to memory of 3864 4684 CCD5.tmp 101 PID 3864 wrote to memory of 4148 3864 CD72.tmp 102 PID 3864 wrote to memory of 4148 3864 CD72.tmp 102 PID 3864 wrote to memory of 4148 3864 CD72.tmp 102 PID 4148 wrote to memory of 3280 4148 CE5C.tmp 103 PID 4148 wrote to memory of 3280 4148 CE5C.tmp 103 PID 4148 wrote to memory of 3280 4148 CE5C.tmp 103 PID 3280 wrote to memory of 232 3280 CF27.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_eaf02bce5abee0d8bd98ed736e6fdcee_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\CA45.tmp"C:\Users\Admin\AppData\Local\Temp\CA45.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"C:\Users\Admin\AppData\Local\Temp\CCD5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\CD72.tmp"C:\Users\Admin\AppData\Local\Temp\CD72.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"23⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"24⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"25⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"26⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"27⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"28⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"C:\Users\Admin\AppData\Local\Temp\D5DE.tmp"29⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"30⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"31⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"32⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"33⤵
- Executes dropped EXE
PID:420 -
C:\Users\Admin\AppData\Local\Temp\DA04.tmp"C:\Users\Admin\AppData\Local\Temp\DA04.tmp"34⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"C:\Users\Admin\AppData\Local\Temp\DAA1.tmp"35⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"C:\Users\Admin\AppData\Local\Temp\DB5C.tmp"36⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"37⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"38⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"39⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"C:\Users\Admin\AppData\Local\Temp\DDEC.tmp"40⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"41⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"42⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"43⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\E07D.tmp"C:\Users\Admin\AppData\Local\Temp\E07D.tmp"44⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"45⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"46⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"47⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"48⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"49⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\E484.tmp"C:\Users\Admin\AppData\Local\Temp\E484.tmp"50⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"51⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"52⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\E649.tmp"C:\Users\Admin\AppData\Local\Temp\E649.tmp"53⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"54⤵
- Executes dropped EXE
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"55⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"56⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"57⤵
- Executes dropped EXE
PID:492 -
C:\Users\Admin\AppData\Local\Temp\E995.tmp"C:\Users\Admin\AppData\Local\Temp\E995.tmp"58⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"59⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"60⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"61⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"62⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"63⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"64⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"65⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"66⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"67⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"68⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"69⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\F09A.tmp"C:\Users\Admin\AppData\Local\Temp\F09A.tmp"70⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"71⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"72⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"73⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\F414.tmp"C:\Users\Admin\AppData\Local\Temp\F414.tmp"74⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"75⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"76⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"77⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"78⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"C:\Users\Admin\AppData\Local\Temp\F6F3.tmp"79⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"80⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"81⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"82⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"83⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"84⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"85⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"86⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"87⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"88⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"89⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\FE46.tmp"C:\Users\Admin\AppData\Local\Temp\FE46.tmp"90⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"91⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"C:\Users\Admin\AppData\Local\Temp\FF9D.tmp"92⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"93⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\A7.tmp"C:\Users\Admin\AppData\Local\Temp\A7.tmp"94⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"95⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"96⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"97⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"98⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\395.tmp"C:\Users\Admin\AppData\Local\Temp\395.tmp"99⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"100⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\599.tmp"C:\Users\Admin\AppData\Local\Temp\599.tmp"102⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"103⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"104⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"105⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"106⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\877.tmp"C:\Users\Admin\AppData\Local\Temp\877.tmp"107⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"108⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"109⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\A0D.tmp"C:\Users\Admin\AppData\Local\Temp\A0D.tmp"110⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\A9A.tmp"C:\Users\Admin\AppData\Local\Temp\A9A.tmp"111⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"112⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"113⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"114⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"115⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"116⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"117⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"118⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"119⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"120⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"121⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"122⤵PID:2320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-