Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 16:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe
-
Size
486KB
-
MD5
2e1320a87b8f5dc299cf017d739e5cf2
-
SHA1
ab9b19ba0a8991ad9a49840f5a2c6ca53b5b912c
-
SHA256
ae9674452d0b9eb2935d1221be1e7969ca8e2c7756bca30f996d6a13bae881a7
-
SHA512
4f7e353e9353fca78ec5b28f6f73b94cadc18b71753e09a10e448c62ad70b2637ba11ae919be90d8f7d1e33222debab7126e0d62b86e5b85dd4dab947593fa0a
-
SSDEEP
12288:UU5rCOTeiDpMP5LRBtYX1Ii/urA8+k7LD9E3NZ:UUQOJDqxLZmIRrApkPDyN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4624 8695.tmp 3124 8750.tmp 948 880C.tmp 3988 88E7.tmp 3480 89A2.tmp 4916 8A4E.tmp 1892 8AFA.tmp 1300 8B96.tmp 2724 8C04.tmp 4912 8CAF.tmp 2044 8D8A.tmp 1620 8E17.tmp 1068 8EB3.tmp 5036 8F30.tmp 2060 901A.tmp 4748 90A7.tmp 2852 9124.tmp 2088 91C0.tmp 1124 926C.tmp 3376 9347.tmp 4412 93C4.tmp 1016 94CE.tmp 2296 9589.tmp 4648 9616.tmp 3656 96A2.tmp 1500 972F.tmp 1576 97CB.tmp 4256 9858.tmp 3460 9923.tmp 2120 99DE.tmp 3624 9A5B.tmp 4204 9AF8.tmp 4464 9BA4.tmp 808 9C21.tmp 4416 9C9E.tmp 1536 9D1B.tmp 4500 9DE6.tmp 1584 9E82.tmp 1708 9EEF.tmp 3532 9F4D.tmp 2796 A1CE.tmp 1228 A25A.tmp 2044 A2D7.tmp 232 A354.tmp 2820 A3C2.tmp 868 A42F.tmp 3680 A48D.tmp 4340 A4FA.tmp 1524 A5F4.tmp 1156 A662.tmp 624 A6CF.tmp 4584 A72D.tmp 1784 A78A.tmp 1028 A7F8.tmp 2652 A875.tmp 800 A8F2.tmp 3400 A95F.tmp 4516 A9CD.tmp 4420 AA1B.tmp 4840 AA98.tmp 836 AB05.tmp 4764 AB72.tmp 1464 ABE0.tmp 2472 AC3E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 4624 2980 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 85 PID 2980 wrote to memory of 4624 2980 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 85 PID 2980 wrote to memory of 4624 2980 2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe 85 PID 4624 wrote to memory of 3124 4624 8695.tmp 86 PID 4624 wrote to memory of 3124 4624 8695.tmp 86 PID 4624 wrote to memory of 3124 4624 8695.tmp 86 PID 3124 wrote to memory of 948 3124 8750.tmp 87 PID 3124 wrote to memory of 948 3124 8750.tmp 87 PID 3124 wrote to memory of 948 3124 8750.tmp 87 PID 948 wrote to memory of 3988 948 880C.tmp 89 PID 948 wrote to memory of 3988 948 880C.tmp 89 PID 948 wrote to memory of 3988 948 880C.tmp 89 PID 3988 wrote to memory of 3480 3988 88E7.tmp 90 PID 3988 wrote to memory of 3480 3988 88E7.tmp 90 PID 3988 wrote to memory of 3480 3988 88E7.tmp 90 PID 3480 wrote to memory of 4916 3480 89A2.tmp 91 PID 3480 wrote to memory of 4916 3480 89A2.tmp 91 PID 3480 wrote to memory of 4916 3480 89A2.tmp 91 PID 4916 wrote to memory of 1892 4916 8A4E.tmp 92 PID 4916 wrote to memory of 1892 4916 8A4E.tmp 92 PID 4916 wrote to memory of 1892 4916 8A4E.tmp 92 PID 1892 wrote to memory of 1300 1892 8AFA.tmp 93 PID 1892 wrote to memory of 1300 1892 8AFA.tmp 93 PID 1892 wrote to memory of 1300 1892 8AFA.tmp 93 PID 1300 wrote to memory of 2724 1300 8B96.tmp 94 PID 1300 wrote to memory of 2724 1300 8B96.tmp 94 PID 1300 wrote to memory of 2724 1300 8B96.tmp 94 PID 2724 wrote to memory of 4912 2724 8C04.tmp 95 PID 2724 wrote to memory of 4912 2724 8C04.tmp 95 PID 2724 wrote to memory of 4912 2724 8C04.tmp 95 PID 4912 wrote to memory of 2044 4912 8CAF.tmp 96 PID 4912 wrote to memory of 2044 4912 8CAF.tmp 96 PID 4912 wrote to memory of 2044 4912 8CAF.tmp 96 PID 2044 wrote to memory of 1620 2044 8D8A.tmp 97 PID 2044 wrote to memory of 1620 2044 8D8A.tmp 97 PID 2044 wrote to memory of 1620 2044 8D8A.tmp 97 PID 1620 wrote to memory of 1068 1620 8E17.tmp 98 PID 1620 wrote to memory of 1068 1620 8E17.tmp 98 PID 1620 wrote to memory of 1068 1620 8E17.tmp 98 PID 1068 wrote to memory of 5036 1068 8EB3.tmp 99 PID 1068 wrote to memory of 5036 1068 8EB3.tmp 99 PID 1068 wrote to memory of 5036 1068 8EB3.tmp 99 PID 5036 wrote to memory of 2060 5036 8F30.tmp 100 PID 5036 wrote to memory of 2060 5036 8F30.tmp 100 PID 5036 wrote to memory of 2060 5036 8F30.tmp 100 PID 2060 wrote to memory of 4748 2060 901A.tmp 101 PID 2060 wrote to memory of 4748 2060 901A.tmp 101 PID 2060 wrote to memory of 4748 2060 901A.tmp 101 PID 4748 wrote to memory of 2852 4748 90A7.tmp 102 PID 4748 wrote to memory of 2852 4748 90A7.tmp 102 PID 4748 wrote to memory of 2852 4748 90A7.tmp 102 PID 2852 wrote to memory of 2088 2852 9124.tmp 105 PID 2852 wrote to memory of 2088 2852 9124.tmp 105 PID 2852 wrote to memory of 2088 2852 9124.tmp 105 PID 2088 wrote to memory of 1124 2088 91C0.tmp 106 PID 2088 wrote to memory of 1124 2088 91C0.tmp 106 PID 2088 wrote to memory of 1124 2088 91C0.tmp 106 PID 1124 wrote to memory of 3376 1124 926C.tmp 107 PID 1124 wrote to memory of 3376 1124 926C.tmp 107 PID 1124 wrote to memory of 3376 1124 926C.tmp 107 PID 3376 wrote to memory of 4412 3376 9347.tmp 108 PID 3376 wrote to memory of 4412 3376 9347.tmp 108 PID 3376 wrote to memory of 4412 3376 9347.tmp 108 PID 4412 wrote to memory of 1016 4412 93C4.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2e1320a87b8f5dc299cf017d739e5cf2_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8750.tmp"C:\Users\Admin\AppData\Local\Temp\8750.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\91C0.tmp"C:\Users\Admin\AppData\Local\Temp\91C0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\926C.tmp"C:\Users\Admin\AppData\Local\Temp\926C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\93C4.tmp"C:\Users\Admin\AppData\Local\Temp\93C4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"23⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"24⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"25⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"26⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"27⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"28⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"29⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"30⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"31⤵
- Executes dropped EXE
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"32⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"33⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"34⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"35⤵
- Executes dropped EXE
PID:808 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"36⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"C:\Users\Admin\AppData\Local\Temp\9D1B.tmp"37⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"38⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"39⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"40⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"41⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"42⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"43⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"44⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"45⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"46⤵
- Executes dropped EXE
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"47⤵
- Executes dropped EXE
PID:868 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"48⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"C:\Users\Admin\AppData\Local\Temp\A4FA.tmp"49⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"50⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"51⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"52⤵
- Executes dropped EXE
PID:624 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"53⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"54⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"55⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"56⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"57⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"58⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"59⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"60⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"61⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"62⤵
- Executes dropped EXE
PID:836 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"63⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"64⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"C:\Users\Admin\AppData\Local\Temp\AC3E.tmp"65⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"66⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"67⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"68⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"C:\Users\Admin\AppData\Local\Temp\ADF3.tmp"69⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"70⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"71⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"72⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"73⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"74⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"75⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"76⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"77⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"78⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"79⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"80⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"81⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"C:\Users\Admin\AppData\Local\Temp\B3DF.tmp"82⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"83⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"84⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"85⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"86⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"87⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"C:\Users\Admin\AppData\Local\Temp\B6BD.tmp"88⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\B72A.tmp"C:\Users\Admin\AppData\Local\Temp\B72A.tmp"89⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"90⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"91⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"92⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"93⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"C:\Users\Admin\AppData\Local\Temp\B9EA.tmp"94⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"95⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"96⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\BB61.tmp"C:\Users\Admin\AppData\Local\Temp\BB61.tmp"97⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"C:\Users\Admin\AppData\Local\Temp\BBCE.tmp"98⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"C:\Users\Admin\AppData\Local\Temp\BC5B.tmp"99⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"C:\Users\Admin\AppData\Local\Temp\BCD8.tmp"100⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"101⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"102⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"103⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"104⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"105⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"106⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"107⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"108⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"109⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"111⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"112⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\C40B.tmp"C:\Users\Admin\AppData\Local\Temp\C40B.tmp"113⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"114⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"115⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"116⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"117⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"C:\Users\Admin\AppData\Local\Temp\C6DA.tmp"118⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\C776.tmp"C:\Users\Admin\AppData\Local\Temp\C776.tmp"119⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"120⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"121⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"122⤵PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-