Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe
-
Size
520KB
-
MD5
ff2ead7aa0a5ae23e9d4ebe1257769e0
-
SHA1
c41a082c37d1d2a31e7bec6e744c8a0dae037ecd
-
SHA256
40c3105be7d7cd75e4c0a65fbc11dde66f9c8bd536484dec05921075862242fb
-
SHA512
4a99518a444d2a815e5262f6c109e31659072d688baea2054bdc11f56512509202ed8bb2b27e1d76a357df8aea9fe5445f95130d79272ca4168929e10676cb48
-
SSDEEP
6144:Aj/hrXj2PAEh5ACnPu07aWiHrPESDQEdydICItdnUerQy7WHsH3dZ:YcRnG07aWijEWXdydIwSPRNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 224 DB1E.tmp 5016 DF92.tmp 1788 E08C.tmp 4708 E138.tmp 4584 E1E4.tmp 1956 E280.tmp 1872 E32C.tmp 2860 E3E8.tmp 2196 E985.tmp 4976 EA9E.tmp 3280 EC15.tmp 3016 ECE0.tmp 4972 EE38.tmp 1556 EED4.tmp 3332 EFA0.tmp 4344 F0C8.tmp 1048 F174.tmp 2172 F339.tmp 3248 F57C.tmp 5096 F656.tmp 2624 F741.tmp 552 F7ED.tmp 2672 F86A.tmp 2712 F944.tmp 4884 FA00.tmp 2580 FB38.tmp 5036 FD9A.tmp 2780 FE36.tmp 4120 FEF1.tmp 4540 FFBD.tmp 2348 68.tmp 2552 124.tmp 4736 347.tmp 3288 3D3.tmp 4796 460.tmp 3632 644.tmp 3284 6A2.tmp 3480 71F.tmp 4676 7EA.tmp 416 867.tmp 1528 8D5.tmp 4100 9DE.tmp 1816 AD8.tmp 1364 B65.tmp 2300 C20.tmp 476 C7E.tmp 5080 CEC.tmp 4516 D88.tmp 1636 EC0.tmp 1428 F2E.tmp 4076 FDA.tmp 2728 1037.tmp 1388 10C4.tmp 2004 1122.tmp 5016 11ED.tmp 3312 126A.tmp 4744 12D7.tmp 644 13A2.tmp 564 141F.tmp 4728 149C.tmp 2084 1558.tmp 4456 171D.tmp 3520 179A.tmp 4504 1836.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 224 2104 2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe 88 PID 2104 wrote to memory of 224 2104 2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe 88 PID 2104 wrote to memory of 224 2104 2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe 88 PID 224 wrote to memory of 5016 224 DB1E.tmp 89 PID 224 wrote to memory of 5016 224 DB1E.tmp 89 PID 224 wrote to memory of 5016 224 DB1E.tmp 89 PID 5016 wrote to memory of 1788 5016 DF92.tmp 90 PID 5016 wrote to memory of 1788 5016 DF92.tmp 90 PID 5016 wrote to memory of 1788 5016 DF92.tmp 90 PID 1788 wrote to memory of 4708 1788 E08C.tmp 92 PID 1788 wrote to memory of 4708 1788 E08C.tmp 92 PID 1788 wrote to memory of 4708 1788 E08C.tmp 92 PID 4708 wrote to memory of 4584 4708 E138.tmp 93 PID 4708 wrote to memory of 4584 4708 E138.tmp 93 PID 4708 wrote to memory of 4584 4708 E138.tmp 93 PID 4584 wrote to memory of 1956 4584 E1E4.tmp 94 PID 4584 wrote to memory of 1956 4584 E1E4.tmp 94 PID 4584 wrote to memory of 1956 4584 E1E4.tmp 94 PID 1956 wrote to memory of 1872 1956 E280.tmp 95 PID 1956 wrote to memory of 1872 1956 E280.tmp 95 PID 1956 wrote to memory of 1872 1956 E280.tmp 95 PID 1872 wrote to memory of 2860 1872 E32C.tmp 96 PID 1872 wrote to memory of 2860 1872 E32C.tmp 96 PID 1872 wrote to memory of 2860 1872 E32C.tmp 96 PID 2860 wrote to memory of 2196 2860 E3E8.tmp 97 PID 2860 wrote to memory of 2196 2860 E3E8.tmp 97 PID 2860 wrote to memory of 2196 2860 E3E8.tmp 97 PID 2196 wrote to memory of 4976 2196 E985.tmp 98 PID 2196 wrote to memory of 4976 2196 E985.tmp 98 PID 2196 wrote to memory of 4976 2196 E985.tmp 98 PID 4976 wrote to memory of 3280 4976 EA9E.tmp 99 PID 4976 wrote to memory of 3280 4976 EA9E.tmp 99 PID 4976 wrote to memory of 3280 4976 EA9E.tmp 99 PID 3280 wrote to memory of 3016 3280 EC15.tmp 100 PID 3280 wrote to memory of 3016 3280 EC15.tmp 100 PID 3280 wrote to memory of 3016 3280 EC15.tmp 100 PID 3016 wrote to memory of 4972 3016 ECE0.tmp 101 PID 3016 wrote to memory of 4972 3016 ECE0.tmp 101 PID 3016 wrote to memory of 4972 3016 ECE0.tmp 101 PID 4972 wrote to memory of 1556 4972 EE38.tmp 102 PID 4972 wrote to memory of 1556 4972 EE38.tmp 102 PID 4972 wrote to memory of 1556 4972 EE38.tmp 102 PID 1556 wrote to memory of 3332 1556 EED4.tmp 103 PID 1556 wrote to memory of 3332 1556 EED4.tmp 103 PID 1556 wrote to memory of 3332 1556 EED4.tmp 103 PID 3332 wrote to memory of 4344 3332 EFA0.tmp 104 PID 3332 wrote to memory of 4344 3332 EFA0.tmp 104 PID 3332 wrote to memory of 4344 3332 EFA0.tmp 104 PID 4344 wrote to memory of 1048 4344 F0C8.tmp 105 PID 4344 wrote to memory of 1048 4344 F0C8.tmp 105 PID 4344 wrote to memory of 1048 4344 F0C8.tmp 105 PID 1048 wrote to memory of 2172 1048 F174.tmp 106 PID 1048 wrote to memory of 2172 1048 F174.tmp 106 PID 1048 wrote to memory of 2172 1048 F174.tmp 106 PID 2172 wrote to memory of 3248 2172 F339.tmp 107 PID 2172 wrote to memory of 3248 2172 F339.tmp 107 PID 2172 wrote to memory of 3248 2172 F339.tmp 107 PID 3248 wrote to memory of 5096 3248 F57C.tmp 108 PID 3248 wrote to memory of 5096 3248 F57C.tmp 108 PID 3248 wrote to memory of 5096 3248 F57C.tmp 108 PID 5096 wrote to memory of 2624 5096 F656.tmp 109 PID 5096 wrote to memory of 2624 5096 F656.tmp 109 PID 5096 wrote to memory of 2624 5096 F656.tmp 109 PID 2624 wrote to memory of 552 2624 F741.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_ff2ead7aa0a5ae23e9d4ebe1257769e0_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"C:\Users\Admin\AppData\Local\Temp\DB1E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\E280.tmp"C:\Users\Admin\AppData\Local\Temp\E280.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\E985.tmp"C:\Users\Admin\AppData\Local\Temp\E985.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"C:\Users\Admin\AppData\Local\Temp\EA9E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"C:\Users\Admin\AppData\Local\Temp\ECE0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\EED4.tmp"C:\Users\Admin\AppData\Local\Temp\EED4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\F57C.tmp"C:\Users\Admin\AppData\Local\Temp\F57C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\F741.tmp"C:\Users\Admin\AppData\Local\Temp\F741.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"C:\Users\Admin\AppData\Local\Temp\F7ED.tmp"23⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\F86A.tmp"C:\Users\Admin\AppData\Local\Temp\F86A.tmp"24⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"25⤵
- Executes dropped EXE
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"26⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\FB38.tmp"C:\Users\Admin\AppData\Local\Temp\FB38.tmp"27⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"28⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"29⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"30⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"31⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"32⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"33⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\347.tmp"C:\Users\Admin\AppData\Local\Temp\347.tmp"34⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"35⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"36⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"37⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"38⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\71F.tmp"C:\Users\Admin\AppData\Local\Temp\71F.tmp"39⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"40⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"41⤵
- Executes dropped EXE
PID:416 -
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"42⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"43⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"44⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"45⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"46⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"47⤵
- Executes dropped EXE
PID:476 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"48⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"49⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"50⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"51⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\FDA.tmp"C:\Users\Admin\AppData\Local\Temp\FDA.tmp"52⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"53⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"54⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"55⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"56⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"57⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"58⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"59⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"60⤵
- Executes dropped EXE
PID:564 -
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"61⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\1558.tmp"C:\Users\Admin\AppData\Local\Temp\1558.tmp"62⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"63⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"64⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"65⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"66⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"67⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"68⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"69⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"70⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"71⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"72⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"73⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"74⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\1E51.tmp"C:\Users\Admin\AppData\Local\Temp\1E51.tmp"75⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"76⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"77⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"78⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2035.tmp"C:\Users\Admin\AppData\Local\Temp\2035.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"80⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"81⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"82⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\242D.tmp"C:\Users\Admin\AppData\Local\Temp\242D.tmp"83⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"84⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"85⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"86⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\26AD.tmp"C:\Users\Admin\AppData\Local\Temp\26AD.tmp"87⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"88⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\27C7.tmp"C:\Users\Admin\AppData\Local\Temp\27C7.tmp"89⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"90⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"91⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"92⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\2A18.tmp"C:\Users\Admin\AppData\Local\Temp\2A18.tmp"93⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"94⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"95⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"96⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"97⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"98⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"99⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"100⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\3033.tmp"C:\Users\Admin\AppData\Local\Temp\3033.tmp"101⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\30CF.tmp"C:\Users\Admin\AppData\Local\Temp\30CF.tmp"102⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"103⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"104⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"105⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"106⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"107⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"108⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"109⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"110⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"111⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\37F3.tmp"C:\Users\Admin\AppData\Local\Temp\37F3.tmp"112⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"113⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"114⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"115⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"116⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"117⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"118⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"119⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"120⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"121⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-