Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2023, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe
-
Size
488KB
-
MD5
97421e93cbef9a09333dfdcafac2556a
-
SHA1
7e9eb85e39c3bf36301a304757656e8aa0dbad8d
-
SHA256
f93026183c70a577517e2d973e41ade7cdff357c0d930a16b5de28d8e31a9b5f
-
SHA512
917bc621dd97277be4bed3eec5f1181543bf97c1a4a1ac0c7e1eeec1286e847a5bc155d8546d1aaaa6e1a3f839ef11113ffa6a97406ccba01fb1ce423c60764f
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7xDF8Gfq/tuSfHODDck5beq9Nhkf81GW58goq:/U5rCOTeiDxDeJ1ffODjKf81GW6gXNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3860 D89D.tmp 2488 D978.tmp 3112 DA14.tmp 988 DEA8.tmp 2628 DF92.tmp 4272 E04E.tmp 5084 E0CB.tmp 2324 E196.tmp 1044 E222.tmp 1160 E2AF.tmp 4336 E32C.tmp 3604 E3B9.tmp 2416 E465.tmp 3676 E58D.tmp 2556 E639.tmp 2208 E6D6.tmp 2088 E772.tmp 1732 E7FE.tmp 3396 E8AA.tmp 1896 E918.tmp 4240 EA02.tmp 816 EB0C.tmp 1104 EBD7.tmp 1352 ECA2.tmp 5080 ED2F.tmp 4720 EDDA.tmp 4312 EE86.tmp 3424 EF13.tmp 4612 EF90.tmp 3428 F04B.tmp 2052 F165.tmp 4340 F24F.tmp 1880 F339.tmp 4472 F3C6.tmp 2492 F453.tmp 4832 F4C0.tmp 2200 F55C.tmp 996 F5D9.tmp 4648 F685.tmp 4700 F721.tmp 3384 F7BE.tmp 4712 F84A.tmp 2960 F8C7.tmp 1836 F944.tmp 2252 F9D1.tmp 2104 FA5E.tmp 4804 FAEA.tmp 2644 FB77.tmp 4888 FC13.tmp 3092 FCAF.tmp 1376 FD3C.tmp 4244 FDD8.tmp 1236 FE74.tmp 4212 FF01.tmp 3472 FF6E.tmp 1532 B.tmp 3192 B7.tmp 1560 153.tmp 3652 1EF.tmp 4408 28B.tmp 3452 337.tmp 2316 3E3.tmp 5036 460.tmp 228 4ED.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 3860 1532 97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe 80 PID 1532 wrote to memory of 3860 1532 97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe 80 PID 1532 wrote to memory of 3860 1532 97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe 80 PID 3860 wrote to memory of 2488 3860 D89D.tmp 81 PID 3860 wrote to memory of 2488 3860 D89D.tmp 81 PID 3860 wrote to memory of 2488 3860 D89D.tmp 81 PID 2488 wrote to memory of 3112 2488 D978.tmp 82 PID 2488 wrote to memory of 3112 2488 D978.tmp 82 PID 2488 wrote to memory of 3112 2488 D978.tmp 82 PID 3112 wrote to memory of 988 3112 DA14.tmp 83 PID 3112 wrote to memory of 988 3112 DA14.tmp 83 PID 3112 wrote to memory of 988 3112 DA14.tmp 83 PID 988 wrote to memory of 2628 988 DEA8.tmp 84 PID 988 wrote to memory of 2628 988 DEA8.tmp 84 PID 988 wrote to memory of 2628 988 DEA8.tmp 84 PID 2628 wrote to memory of 4272 2628 DF92.tmp 85 PID 2628 wrote to memory of 4272 2628 DF92.tmp 85 PID 2628 wrote to memory of 4272 2628 DF92.tmp 85 PID 4272 wrote to memory of 5084 4272 E04E.tmp 86 PID 4272 wrote to memory of 5084 4272 E04E.tmp 86 PID 4272 wrote to memory of 5084 4272 E04E.tmp 86 PID 5084 wrote to memory of 2324 5084 E0CB.tmp 87 PID 5084 wrote to memory of 2324 5084 E0CB.tmp 87 PID 5084 wrote to memory of 2324 5084 E0CB.tmp 87 PID 2324 wrote to memory of 1044 2324 E196.tmp 88 PID 2324 wrote to memory of 1044 2324 E196.tmp 88 PID 2324 wrote to memory of 1044 2324 E196.tmp 88 PID 1044 wrote to memory of 1160 1044 E222.tmp 90 PID 1044 wrote to memory of 1160 1044 E222.tmp 90 PID 1044 wrote to memory of 1160 1044 E222.tmp 90 PID 1160 wrote to memory of 4336 1160 E2AF.tmp 91 PID 1160 wrote to memory of 4336 1160 E2AF.tmp 91 PID 1160 wrote to memory of 4336 1160 E2AF.tmp 91 PID 4336 wrote to memory of 3604 4336 E32C.tmp 92 PID 4336 wrote to memory of 3604 4336 E32C.tmp 92 PID 4336 wrote to memory of 3604 4336 E32C.tmp 92 PID 3604 wrote to memory of 2416 3604 E3B9.tmp 93 PID 3604 wrote to memory of 2416 3604 E3B9.tmp 93 PID 3604 wrote to memory of 2416 3604 E3B9.tmp 93 PID 2416 wrote to memory of 3676 2416 E465.tmp 94 PID 2416 wrote to memory of 3676 2416 E465.tmp 94 PID 2416 wrote to memory of 3676 2416 E465.tmp 94 PID 3676 wrote to memory of 2556 3676 E58D.tmp 95 PID 3676 wrote to memory of 2556 3676 E58D.tmp 95 PID 3676 wrote to memory of 2556 3676 E58D.tmp 95 PID 2556 wrote to memory of 2208 2556 E639.tmp 96 PID 2556 wrote to memory of 2208 2556 E639.tmp 96 PID 2556 wrote to memory of 2208 2556 E639.tmp 96 PID 2208 wrote to memory of 2088 2208 E6D6.tmp 97 PID 2208 wrote to memory of 2088 2208 E6D6.tmp 97 PID 2208 wrote to memory of 2088 2208 E6D6.tmp 97 PID 2088 wrote to memory of 1732 2088 E772.tmp 98 PID 2088 wrote to memory of 1732 2088 E772.tmp 98 PID 2088 wrote to memory of 1732 2088 E772.tmp 98 PID 1732 wrote to memory of 3396 1732 E7FE.tmp 101 PID 1732 wrote to memory of 3396 1732 E7FE.tmp 101 PID 1732 wrote to memory of 3396 1732 E7FE.tmp 101 PID 3396 wrote to memory of 1896 3396 E8AA.tmp 102 PID 3396 wrote to memory of 1896 3396 E8AA.tmp 102 PID 3396 wrote to memory of 1896 3396 E8AA.tmp 102 PID 1896 wrote to memory of 4240 1896 E918.tmp 103 PID 1896 wrote to memory of 4240 1896 E918.tmp 103 PID 1896 wrote to memory of 4240 1896 E918.tmp 103 PID 4240 wrote to memory of 816 4240 EA02.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\97421e93cbef9a09333dfdcafac2556a_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\D978.tmp"C:\Users\Admin\AppData\Local\Temp\D978.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\DA14.tmp"C:\Users\Admin\AppData\Local\Temp\DA14.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\DF92.tmp"C:\Users\Admin\AppData\Local\Temp\DF92.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"C:\Users\Admin\AppData\Local\Temp\E0CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E222.tmp"C:\Users\Admin\AppData\Local\Temp\E222.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\E639.tmp"C:\Users\Admin\AppData\Local\Temp\E639.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\E918.tmp"C:\Users\Admin\AppData\Local\Temp\E918.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"23⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"24⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"C:\Users\Admin\AppData\Local\Temp\ECA2.tmp"25⤵
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"26⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"27⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"28⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\EF13.tmp"C:\Users\Admin\AppData\Local\Temp\EF13.tmp"29⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"30⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"31⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"32⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"33⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F339.tmp"C:\Users\Admin\AppData\Local\Temp\F339.tmp"34⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"35⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"36⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"37⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\F55C.tmp"C:\Users\Admin\AppData\Local\Temp\F55C.tmp"38⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"39⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"40⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\F721.tmp"C:\Users\Admin\AppData\Local\Temp\F721.tmp"41⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"C:\Users\Admin\AppData\Local\Temp\F7BE.tmp"42⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"43⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"C:\Users\Admin\AppData\Local\Temp\F8C7.tmp"44⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"45⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"46⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"C:\Users\Admin\AppData\Local\Temp\FA5E.tmp"47⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"48⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"49⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"50⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"C:\Users\Admin\AppData\Local\Temp\FCAF.tmp"51⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"C:\Users\Admin\AppData\Local\Temp\FD3C.tmp"52⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"53⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"54⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"55⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"56⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"57⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"58⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\153.tmp"C:\Users\Admin\AppData\Local\Temp\153.tmp"59⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1EF.tmp"C:\Users\Admin\AppData\Local\Temp\1EF.tmp"60⤵
- Executes dropped EXE
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"61⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\337.tmp"C:\Users\Admin\AppData\Local\Temp\337.tmp"62⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"63⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\460.tmp"C:\Users\Admin\AppData\Local\Temp\460.tmp"64⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4ED.tmp"C:\Users\Admin\AppData\Local\Temp\4ED.tmp"65⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"66⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"67⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"68⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\6B2.tmp"C:\Users\Admin\AppData\Local\Temp\6B2.tmp"69⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"70⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\7BB.tmp"C:\Users\Admin\AppData\Local\Temp\7BB.tmp"71⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"72⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"73⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"74⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"75⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"76⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"77⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\B46.tmp"C:\Users\Admin\AppData\Local\Temp\B46.tmp"78⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"79⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"80⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"81⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"82⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"83⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"84⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"85⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"86⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"87⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"88⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"89⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"90⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"91⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"92⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\124B.tmp"C:\Users\Admin\AppData\Local\Temp\124B.tmp"93⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"94⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"95⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"96⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"97⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"98⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"99⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"100⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\16BF.tmp"C:\Users\Admin\AppData\Local\Temp\16BF.tmp"101⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"102⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"103⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"104⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"105⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"106⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"107⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"C:\Users\Admin\AppData\Local\Temp\1AB7.tmp"108⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"109⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"110⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"C:\Users\Admin\AppData\Local\Temp\1C5D.tmp"111⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"112⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"113⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\1E22.tmp"C:\Users\Admin\AppData\Local\Temp\1E22.tmp"114⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"115⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"C:\Users\Admin\AppData\Local\Temp\1F3B.tmp"116⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"117⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"118⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"119⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"120⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"121⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"122⤵PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-