Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe
-
Size
486KB
-
MD5
0ece87542c9c201b1879b950f1bf0364
-
SHA1
121738039e401c34fd3330c9150b47ccf31f3844
-
SHA256
e973cfcd6b1229a995b6f00f2a3b0f795b012064e9de02b0baed1d2c0d1b9667
-
SHA512
fc14a18498f4363b64959dc13f7269ba09aacf6b9bfc03302d576fce70c42b7f214683d6164b47edbc021a97daa3ea20b2ab5678e97727aa12c4a2f9e4b74de7
-
SSDEEP
12288:/U5rCOTeiDCv/EeDbbfNVqUj7MLlO1NZ:/UQOJDCv/EeDXNQUj91N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4932 9AD8.tmp 2120 9B94.tmp 4924 9C40.tmp 836 9D49.tmp 4536 9DF5.tmp 3608 9F0F.tmp 3572 9FCA.tmp 2772 A103.tmp 3068 A1ED.tmp 3720 A316.tmp 2000 A42F.tmp 2632 A519.tmp 1384 A5F4.tmp 4176 A72D.tmp 1136 A7D9.tmp 1344 A8C3.tmp 4848 A9DC.tmp 4088 AAB7.tmp 3892 AB72.tmp 1364 AC0F.tmp 568 ACAB.tmp 3716 AD47.tmp 4532 AE03.tmp 376 AECE.tmp 1920 AF6A.tmp 3352 B016.tmp 4692 B0A3.tmp 1564 B14E.tmp 4640 B1FA.tmp 940 B277.tmp 4376 B314.tmp 4488 B3CF.tmp 4156 B47B.tmp 2492 B546.tmp 4820 B5C3.tmp 3676 B66F.tmp 3508 B6EC.tmp 2084 B769.tmp 4360 B805.tmp 1676 B873.tmp 1660 B8F0.tmp 648 B97C.tmp 4840 B9F9.tmp 1744 BA95.tmp 4528 BB32.tmp 4184 BBAF.tmp 572 BC1C.tmp 1972 BCB8.tmp 2096 BD55.tmp 4252 BDD2.tmp 2816 BE3F.tmp 3420 BEAC.tmp 3860 BF1A.tmp 4108 BF87.tmp 4368 BFD5.tmp 404 C033.tmp 4796 C0C0.tmp 2904 C14C.tmp 4308 C1E8.tmp 2264 C275.tmp 4512 C302.tmp 3880 C36F.tmp 2812 C3FC.tmp 4928 C488.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4932 4456 0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe 82 PID 4456 wrote to memory of 4932 4456 0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe 82 PID 4456 wrote to memory of 4932 4456 0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe 82 PID 4932 wrote to memory of 2120 4932 9AD8.tmp 83 PID 4932 wrote to memory of 2120 4932 9AD8.tmp 83 PID 4932 wrote to memory of 2120 4932 9AD8.tmp 83 PID 2120 wrote to memory of 4924 2120 9B94.tmp 84 PID 2120 wrote to memory of 4924 2120 9B94.tmp 84 PID 2120 wrote to memory of 4924 2120 9B94.tmp 84 PID 4924 wrote to memory of 836 4924 9C40.tmp 85 PID 4924 wrote to memory of 836 4924 9C40.tmp 85 PID 4924 wrote to memory of 836 4924 9C40.tmp 85 PID 836 wrote to memory of 4536 836 9D49.tmp 86 PID 836 wrote to memory of 4536 836 9D49.tmp 86 PID 836 wrote to memory of 4536 836 9D49.tmp 86 PID 4536 wrote to memory of 3608 4536 9DF5.tmp 87 PID 4536 wrote to memory of 3608 4536 9DF5.tmp 87 PID 4536 wrote to memory of 3608 4536 9DF5.tmp 87 PID 3608 wrote to memory of 3572 3608 9F0F.tmp 88 PID 3608 wrote to memory of 3572 3608 9F0F.tmp 88 PID 3608 wrote to memory of 3572 3608 9F0F.tmp 88 PID 3572 wrote to memory of 2772 3572 9FCA.tmp 89 PID 3572 wrote to memory of 2772 3572 9FCA.tmp 89 PID 3572 wrote to memory of 2772 3572 9FCA.tmp 89 PID 2772 wrote to memory of 3068 2772 A103.tmp 90 PID 2772 wrote to memory of 3068 2772 A103.tmp 90 PID 2772 wrote to memory of 3068 2772 A103.tmp 90 PID 3068 wrote to memory of 3720 3068 A1ED.tmp 91 PID 3068 wrote to memory of 3720 3068 A1ED.tmp 91 PID 3068 wrote to memory of 3720 3068 A1ED.tmp 91 PID 3720 wrote to memory of 2000 3720 A316.tmp 92 PID 3720 wrote to memory of 2000 3720 A316.tmp 92 PID 3720 wrote to memory of 2000 3720 A316.tmp 92 PID 2000 wrote to memory of 2632 2000 A42F.tmp 93 PID 2000 wrote to memory of 2632 2000 A42F.tmp 93 PID 2000 wrote to memory of 2632 2000 A42F.tmp 93 PID 2632 wrote to memory of 1384 2632 A519.tmp 94 PID 2632 wrote to memory of 1384 2632 A519.tmp 94 PID 2632 wrote to memory of 1384 2632 A519.tmp 94 PID 1384 wrote to memory of 4176 1384 A5F4.tmp 95 PID 1384 wrote to memory of 4176 1384 A5F4.tmp 95 PID 1384 wrote to memory of 4176 1384 A5F4.tmp 95 PID 4176 wrote to memory of 1136 4176 A72D.tmp 96 PID 4176 wrote to memory of 1136 4176 A72D.tmp 96 PID 4176 wrote to memory of 1136 4176 A72D.tmp 96 PID 1136 wrote to memory of 1344 1136 A7D9.tmp 97 PID 1136 wrote to memory of 1344 1136 A7D9.tmp 97 PID 1136 wrote to memory of 1344 1136 A7D9.tmp 97 PID 1344 wrote to memory of 4848 1344 A8C3.tmp 98 PID 1344 wrote to memory of 4848 1344 A8C3.tmp 98 PID 1344 wrote to memory of 4848 1344 A8C3.tmp 98 PID 4848 wrote to memory of 4088 4848 A9DC.tmp 99 PID 4848 wrote to memory of 4088 4848 A9DC.tmp 99 PID 4848 wrote to memory of 4088 4848 A9DC.tmp 99 PID 4088 wrote to memory of 3892 4088 AAB7.tmp 100 PID 4088 wrote to memory of 3892 4088 AAB7.tmp 100 PID 4088 wrote to memory of 3892 4088 AAB7.tmp 100 PID 3892 wrote to memory of 1364 3892 AB72.tmp 101 PID 3892 wrote to memory of 1364 3892 AB72.tmp 101 PID 3892 wrote to memory of 1364 3892 AB72.tmp 101 PID 1364 wrote to memory of 568 1364 AC0F.tmp 102 PID 1364 wrote to memory of 568 1364 AC0F.tmp 102 PID 1364 wrote to memory of 568 1364 AC0F.tmp 102 PID 568 wrote to memory of 3716 568 ACAB.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\0ece87542c9c201b1879b950f1bf0364_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"C:\Users\Admin\AppData\Local\Temp\9AD8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9C40.tmp"C:\Users\Admin\AppData\Local\Temp\9C40.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\AB72.tmp"C:\Users\Admin\AppData\Local\Temp\AB72.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"23⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"24⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\AECE.tmp"C:\Users\Admin\AppData\Local\Temp\AECE.tmp"25⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"26⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"27⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"28⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\B14E.tmp"C:\Users\Admin\AppData\Local\Temp\B14E.tmp"29⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"C:\Users\Admin\AppData\Local\Temp\B1FA.tmp"30⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"31⤵
- Executes dropped EXE
PID:940 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"32⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"33⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"34⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"35⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"36⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"37⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"38⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"39⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"40⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\B873.tmp"C:\Users\Admin\AppData\Local\Temp\B873.tmp"41⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"C:\Users\Admin\AppData\Local\Temp\B8F0.tmp"42⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"43⤵
- Executes dropped EXE
PID:648 -
C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"C:\Users\Admin\AppData\Local\Temp\B9F9.tmp"44⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\BA95.tmp"C:\Users\Admin\AppData\Local\Temp\BA95.tmp"45⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"46⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"C:\Users\Admin\AppData\Local\Temp\BBAF.tmp"47⤵
- Executes dropped EXE
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"48⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"49⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"50⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"C:\Users\Admin\AppData\Local\Temp\BDD2.tmp"51⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"C:\Users\Admin\AppData\Local\Temp\BE3F.tmp"52⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"53⤵
- Executes dropped EXE
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"54⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"55⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"56⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"57⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"58⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"59⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"60⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"61⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"62⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"63⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"64⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"65⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"66⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"67⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"68⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"69⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"70⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\C832.tmp"C:\Users\Admin\AppData\Local\Temp\C832.tmp"71⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"72⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"73⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"74⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\CA74.tmp"C:\Users\Admin\AppData\Local\Temp\CA74.tmp"75⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"76⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"C:\Users\Admin\AppData\Local\Temp\CB8D.tmp"77⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\CC39.tmp"C:\Users\Admin\AppData\Local\Temp\CC39.tmp"78⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"79⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"80⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"81⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"C:\Users\Admin\AppData\Local\Temp\CEAA.tmp"82⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"83⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\D011.tmp"C:\Users\Admin\AppData\Local\Temp\D011.tmp"84⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\D09E.tmp"C:\Users\Admin\AppData\Local\Temp\D09E.tmp"85⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"86⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"87⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"88⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"C:\Users\Admin\AppData\Local\Temp\D2C1.tmp"89⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\D33E.tmp"C:\Users\Admin\AppData\Local\Temp\D33E.tmp"90⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"91⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\D486.tmp"C:\Users\Admin\AppData\Local\Temp\D486.tmp"92⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\D513.tmp"C:\Users\Admin\AppData\Local\Temp\D513.tmp"93⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"94⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"95⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"96⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"97⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"98⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"C:\Users\Admin\AppData\Local\Temp\D7B3.tmp"99⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"100⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\D89D.tmp"C:\Users\Admin\AppData\Local\Temp\D89D.tmp"101⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\D92A.tmp"C:\Users\Admin\AppData\Local\Temp\D92A.tmp"102⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D997.tmp"C:\Users\Admin\AppData\Local\Temp\D997.tmp"103⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"104⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"C:\Users\Admin\AppData\Local\Temp\DAB0.tmp"105⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"106⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"107⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp"C:\Users\Admin\AppData\Local\Temp\DC56.tmp"108⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"C:\Users\Admin\AppData\Local\Temp\DCD3.tmp"109⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"110⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"111⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"112⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"113⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"114⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\E000.tmp"C:\Users\Admin\AppData\Local\Temp\E000.tmp"115⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\E09C.tmp"C:\Users\Admin\AppData\Local\Temp\E09C.tmp"116⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"117⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"C:\Users\Admin\AppData\Local\Temp\E1A5.tmp"118⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"119⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"120⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"121⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"122⤵PID:3756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-