Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 14:55
Static task
static1
Behavioral task
behavioral1
Sample
292c7393e679abb760a5f39da6117317_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
292c7393e679abb760a5f39da6117317_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
292c7393e679abb760a5f39da6117317_mafia_JC.exe
-
Size
487KB
-
MD5
292c7393e679abb760a5f39da6117317
-
SHA1
0034231d56f903be69ad7f440b7881f3fc935340
-
SHA256
c3fea8ddc0b9717e40c5f3eb76fbdd725b05984aeed240680667b63db76a177f
-
SHA512
2196d473f39686a8b1fb43b5d7e4b12af0301af9c29ada208c434d8a0e361b66a37677409973344fd34c3ad342dbf50ce39e563f54a3b3b4a73d12987662d860
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUGWtSdfvzJ/Z5649vQbIdUQA2qBahj3lQdmsz:HU5rCOTeiJytezJRwne6DaZKdXNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4456 9C5F.tmp 3532 9CFB.tmp 1916 9DD6.tmp 1132 9E92.tmp 4520 9F6C.tmp 844 A018.tmp 4472 A0B4.tmp 3712 A151.tmp 2000 A1ED.tmp 1476 A2F7.tmp 1016 A3B2.tmp 3724 A41F.tmp 2820 A4AC.tmp 4916 A539.tmp 2948 A690.tmp 3228 A72D.tmp 1628 A7E8.tmp 2560 A884.tmp 3888 A930.tmp 3892 A9BD.tmp 1216 AAB7.tmp 2088 AB63.tmp 3868 ABEF.tmp 4080 AC7C.tmp 4320 AD47.tmp 3180 ADF3.tmp 1456 AE8F.tmp 1920 AF3B.tmp 2536 AFF7.tmp 4028 B0A3.tmp 712 B15E.tmp 4780 B21A.tmp 732 B2B6.tmp 2808 B333.tmp 2128 B3BF.tmp 3336 B46B.tmp 4504 B517.tmp 3172 B5A4.tmp 4296 B65F.tmp 2696 B70B.tmp 2344 B7B7.tmp 4808 B844.tmp 3784 B8D0.tmp 3680 B95D.tmp 3320 B9EA.tmp 1432 BA86.tmp 3848 BB22.tmp 2040 BBAF.tmp 4896 BC3B.tmp 4420 BCD8.tmp 452 BD74.tmp 2148 BE2F.tmp 4520 BEAC.tmp 4904 BF39.tmp 2288 BFD5.tmp 3540 C062.tmp 3712 C0EE.tmp 1936 C19A.tmp 4632 C217.tmp 3272 C2A4.tmp 4716 C331.tmp 3724 C3AE.tmp 1100 C41B.tmp 1204 C479.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4456 4580 292c7393e679abb760a5f39da6117317_mafia_JC.exe 85 PID 4580 wrote to memory of 4456 4580 292c7393e679abb760a5f39da6117317_mafia_JC.exe 85 PID 4580 wrote to memory of 4456 4580 292c7393e679abb760a5f39da6117317_mafia_JC.exe 85 PID 4456 wrote to memory of 3532 4456 9C5F.tmp 86 PID 4456 wrote to memory of 3532 4456 9C5F.tmp 86 PID 4456 wrote to memory of 3532 4456 9C5F.tmp 86 PID 3532 wrote to memory of 1916 3532 9CFB.tmp 88 PID 3532 wrote to memory of 1916 3532 9CFB.tmp 88 PID 3532 wrote to memory of 1916 3532 9CFB.tmp 88 PID 1916 wrote to memory of 1132 1916 9DD6.tmp 89 PID 1916 wrote to memory of 1132 1916 9DD6.tmp 89 PID 1916 wrote to memory of 1132 1916 9DD6.tmp 89 PID 1132 wrote to memory of 4520 1132 9E92.tmp 90 PID 1132 wrote to memory of 4520 1132 9E92.tmp 90 PID 1132 wrote to memory of 4520 1132 9E92.tmp 90 PID 4520 wrote to memory of 844 4520 9F6C.tmp 91 PID 4520 wrote to memory of 844 4520 9F6C.tmp 91 PID 4520 wrote to memory of 844 4520 9F6C.tmp 91 PID 844 wrote to memory of 4472 844 A018.tmp 92 PID 844 wrote to memory of 4472 844 A018.tmp 92 PID 844 wrote to memory of 4472 844 A018.tmp 92 PID 4472 wrote to memory of 3712 4472 A0B4.tmp 93 PID 4472 wrote to memory of 3712 4472 A0B4.tmp 93 PID 4472 wrote to memory of 3712 4472 A0B4.tmp 93 PID 3712 wrote to memory of 2000 3712 A151.tmp 94 PID 3712 wrote to memory of 2000 3712 A151.tmp 94 PID 3712 wrote to memory of 2000 3712 A151.tmp 94 PID 2000 wrote to memory of 1476 2000 A1ED.tmp 95 PID 2000 wrote to memory of 1476 2000 A1ED.tmp 95 PID 2000 wrote to memory of 1476 2000 A1ED.tmp 95 PID 1476 wrote to memory of 1016 1476 A2F7.tmp 96 PID 1476 wrote to memory of 1016 1476 A2F7.tmp 96 PID 1476 wrote to memory of 1016 1476 A2F7.tmp 96 PID 1016 wrote to memory of 3724 1016 A3B2.tmp 97 PID 1016 wrote to memory of 3724 1016 A3B2.tmp 97 PID 1016 wrote to memory of 3724 1016 A3B2.tmp 97 PID 3724 wrote to memory of 2820 3724 A41F.tmp 98 PID 3724 wrote to memory of 2820 3724 A41F.tmp 98 PID 3724 wrote to memory of 2820 3724 A41F.tmp 98 PID 2820 wrote to memory of 4916 2820 A4AC.tmp 99 PID 2820 wrote to memory of 4916 2820 A4AC.tmp 99 PID 2820 wrote to memory of 4916 2820 A4AC.tmp 99 PID 4916 wrote to memory of 2948 4916 A539.tmp 102 PID 4916 wrote to memory of 2948 4916 A539.tmp 102 PID 4916 wrote to memory of 2948 4916 A539.tmp 102 PID 2948 wrote to memory of 3228 2948 A690.tmp 103 PID 2948 wrote to memory of 3228 2948 A690.tmp 103 PID 2948 wrote to memory of 3228 2948 A690.tmp 103 PID 3228 wrote to memory of 1628 3228 A72D.tmp 104 PID 3228 wrote to memory of 1628 3228 A72D.tmp 104 PID 3228 wrote to memory of 1628 3228 A72D.tmp 104 PID 1628 wrote to memory of 2560 1628 A7E8.tmp 105 PID 1628 wrote to memory of 2560 1628 A7E8.tmp 105 PID 1628 wrote to memory of 2560 1628 A7E8.tmp 105 PID 2560 wrote to memory of 3888 2560 A884.tmp 106 PID 2560 wrote to memory of 3888 2560 A884.tmp 106 PID 2560 wrote to memory of 3888 2560 A884.tmp 106 PID 3888 wrote to memory of 3892 3888 A930.tmp 107 PID 3888 wrote to memory of 3892 3888 A930.tmp 107 PID 3888 wrote to memory of 3892 3888 A930.tmp 107 PID 3892 wrote to memory of 1216 3892 A9BD.tmp 108 PID 3892 wrote to memory of 1216 3892 A9BD.tmp 108 PID 3892 wrote to memory of 1216 3892 A9BD.tmp 108 PID 1216 wrote to memory of 2088 1216 AAB7.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\292c7393e679abb760a5f39da6117317_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\292c7393e679abb760a5f39da6117317_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\A930.tmp"C:\Users\Admin\AppData\Local\Temp\A930.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"23⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"C:\Users\Admin\AppData\Local\Temp\ABEF.tmp"24⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"C:\Users\Admin\AppData\Local\Temp\AC7C.tmp"25⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"26⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"27⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"28⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"29⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"C:\Users\Admin\AppData\Local\Temp\AFF7.tmp"30⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"31⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\B15E.tmp"C:\Users\Admin\AppData\Local\Temp\B15E.tmp"32⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"33⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"34⤵
- Executes dropped EXE
PID:732 -
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"35⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"36⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"37⤵
- Executes dropped EXE
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"38⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"39⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"40⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"41⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"42⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"43⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"44⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"45⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"46⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\BA86.tmp"C:\Users\Admin\AppData\Local\Temp\BA86.tmp"47⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"48⤵
- Executes dropped EXE
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"49⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"50⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"51⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"52⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"C:\Users\Admin\AppData\Local\Temp\BE2F.tmp"53⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"54⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"55⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"56⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"57⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"58⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"59⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"60⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"61⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"62⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"63⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"64⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"65⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"66⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"67⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"68⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"69⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"70⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"71⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\C890.tmp"C:\Users\Admin\AppData\Local\Temp\C890.tmp"72⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"73⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"74⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\CA16.tmp"C:\Users\Admin\AppData\Local\Temp\CA16.tmp"75⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"C:\Users\Admin\AppData\Local\Temp\CAA3.tmp"76⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"77⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"78⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"79⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"80⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"81⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"C:\Users\Admin\AppData\Local\Temp\CDB0.tmp"82⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"83⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"84⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\CF17.tmp"C:\Users\Admin\AppData\Local\Temp\CF17.tmp"85⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"86⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"87⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"88⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"C:\Users\Admin\AppData\Local\Temp\D0FC.tmp"89⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"90⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"91⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"C:\Users\Admin\AppData\Local\Temp\D2D1.tmp"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"93⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"C:\Users\Admin\AppData\Local\Temp\D3BB.tmp"94⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"95⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"C:\Users\Admin\AppData\Local\Temp\D4D4.tmp"96⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"97⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"98⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\D699.tmp"C:\Users\Admin\AppData\Local\Temp\D699.tmp"99⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\D726.tmp"C:\Users\Admin\AppData\Local\Temp\D726.tmp"100⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"C:\Users\Admin\AppData\Local\Temp\D7A3.tmp"101⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"102⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"103⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"104⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"105⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\DA62.tmp"C:\Users\Admin\AppData\Local\Temp\DA62.tmp"106⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"107⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"108⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\DC18.tmp"C:\Users\Admin\AppData\Local\Temp\DC18.tmp"109⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"110⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"111⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"C:\Users\Admin\AppData\Local\Temp\DD8F.tmp"112⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"113⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"114⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"115⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"C:\Users\Admin\AppData\Local\Temp\DFA2.tmp"116⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\E01F.tmp"C:\Users\Admin\AppData\Local\Temp\E01F.tmp"117⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"118⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"119⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"120⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"121⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"C:\Users\Admin\AppData\Local\Temp\E2FD.tmp"122⤵PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-