Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe
-
Size
488KB
-
MD5
464ef6eedef535ef253419ae9abfa3ea
-
SHA1
ec4d283df3f93c43be196065f4145e808df218d6
-
SHA256
e77fedd7c33c5523a4f47bab2521c4564f3220d37e9b7f706a842753250bc860
-
SHA512
2926381b447037d81bcc60f49364ed9c3f4ba462bcb081221c92e33cf87c73eda2741c6b2099224aa7f562be5c4787242e85a56e87f68d80ee38c8169f43eb65
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7KOjtDXhEXdLc9hnyMMXRdT0R18IQTJWMUEVk:/U5rCOTeiDJxGt+yLP0DcB1Vj1gNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4968 B824.tmp 3772 B8E0.tmp 4480 B98C.tmp 4792 BA38.tmp 1076 BB32.tmp 4472 BC0C.tmp 4188 BCC8.tmp 2564 BD55.tmp 4440 BE10.tmp 2080 BE8D.tmp 1976 BF58.tmp 1052 C014.tmp 3736 C14C.tmp 3852 C1F8.tmp 2336 C2A4.tmp 1748 C37F.tmp 2384 C459.tmp 220 C4F6.tmp 2180 C5C1.tmp 3984 C63E.tmp 2872 C728.tmp 3120 C7E4.tmp 3732 C8CE.tmp 2672 C9C8.tmp 2192 CA55.tmp 464 CB2F.tmp 2224 CBFB.tmp 4656 CC87.tmp 3968 CD52.tmp 3348 CE1D.tmp 4500 CF08.tmp 3728 D002.tmp 1292 D179.tmp 1632 D205.tmp 4584 D2A2.tmp 3280 D32E.tmp 4528 D3CB.tmp 8 D457.tmp 4820 D4F3.tmp 2884 D59F.tmp 3952 D63C.tmp 3204 D6E7.tmp 3364 D784.tmp 1428 D830.tmp 1012 D8BC.tmp 4596 D949.tmp 2044 D9C6.tmp 640 DA72.tmp 100 DAFE.tmp 4360 DBC9.tmp 4788 DC75.tmp 404 DD02.tmp 1220 DD7F.tmp 3776 DDFC.tmp 4988 DE98.tmp 3536 DF25.tmp 548 DFC1.tmp 3772 E04E.tmp 3476 E0EA.tmp 2524 E177.tmp 1824 E1F4.tmp 5072 E251.tmp 4440 E2AF.tmp 2080 E31C.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4968 4988 464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe 82 PID 4988 wrote to memory of 4968 4988 464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe 82 PID 4988 wrote to memory of 4968 4988 464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe 82 PID 4968 wrote to memory of 3772 4968 B824.tmp 83 PID 4968 wrote to memory of 3772 4968 B824.tmp 83 PID 4968 wrote to memory of 3772 4968 B824.tmp 83 PID 3772 wrote to memory of 4480 3772 B8E0.tmp 84 PID 3772 wrote to memory of 4480 3772 B8E0.tmp 84 PID 3772 wrote to memory of 4480 3772 B8E0.tmp 84 PID 4480 wrote to memory of 4792 4480 B98C.tmp 85 PID 4480 wrote to memory of 4792 4480 B98C.tmp 85 PID 4480 wrote to memory of 4792 4480 B98C.tmp 85 PID 4792 wrote to memory of 1076 4792 BA38.tmp 86 PID 4792 wrote to memory of 1076 4792 BA38.tmp 86 PID 4792 wrote to memory of 1076 4792 BA38.tmp 86 PID 1076 wrote to memory of 4472 1076 BB32.tmp 87 PID 1076 wrote to memory of 4472 1076 BB32.tmp 87 PID 1076 wrote to memory of 4472 1076 BB32.tmp 87 PID 4472 wrote to memory of 4188 4472 BC0C.tmp 88 PID 4472 wrote to memory of 4188 4472 BC0C.tmp 88 PID 4472 wrote to memory of 4188 4472 BC0C.tmp 88 PID 4188 wrote to memory of 2564 4188 BCC8.tmp 89 PID 4188 wrote to memory of 2564 4188 BCC8.tmp 89 PID 4188 wrote to memory of 2564 4188 BCC8.tmp 89 PID 2564 wrote to memory of 4440 2564 BD55.tmp 90 PID 2564 wrote to memory of 4440 2564 BD55.tmp 90 PID 2564 wrote to memory of 4440 2564 BD55.tmp 90 PID 4440 wrote to memory of 2080 4440 BE10.tmp 91 PID 4440 wrote to memory of 2080 4440 BE10.tmp 91 PID 4440 wrote to memory of 2080 4440 BE10.tmp 91 PID 2080 wrote to memory of 1976 2080 BE8D.tmp 93 PID 2080 wrote to memory of 1976 2080 BE8D.tmp 93 PID 2080 wrote to memory of 1976 2080 BE8D.tmp 93 PID 1976 wrote to memory of 1052 1976 BF58.tmp 94 PID 1976 wrote to memory of 1052 1976 BF58.tmp 94 PID 1976 wrote to memory of 1052 1976 BF58.tmp 94 PID 1052 wrote to memory of 3736 1052 C014.tmp 95 PID 1052 wrote to memory of 3736 1052 C014.tmp 95 PID 1052 wrote to memory of 3736 1052 C014.tmp 95 PID 3736 wrote to memory of 3852 3736 C14C.tmp 96 PID 3736 wrote to memory of 3852 3736 C14C.tmp 96 PID 3736 wrote to memory of 3852 3736 C14C.tmp 96 PID 3852 wrote to memory of 2336 3852 C1F8.tmp 97 PID 3852 wrote to memory of 2336 3852 C1F8.tmp 97 PID 3852 wrote to memory of 2336 3852 C1F8.tmp 97 PID 2336 wrote to memory of 1748 2336 C2A4.tmp 98 PID 2336 wrote to memory of 1748 2336 C2A4.tmp 98 PID 2336 wrote to memory of 1748 2336 C2A4.tmp 98 PID 1748 wrote to memory of 2384 1748 C37F.tmp 99 PID 1748 wrote to memory of 2384 1748 C37F.tmp 99 PID 1748 wrote to memory of 2384 1748 C37F.tmp 99 PID 2384 wrote to memory of 220 2384 C459.tmp 100 PID 2384 wrote to memory of 220 2384 C459.tmp 100 PID 2384 wrote to memory of 220 2384 C459.tmp 100 PID 220 wrote to memory of 2180 220 C4F6.tmp 103 PID 220 wrote to memory of 2180 220 C4F6.tmp 103 PID 220 wrote to memory of 2180 220 C4F6.tmp 103 PID 2180 wrote to memory of 3984 2180 C5C1.tmp 104 PID 2180 wrote to memory of 3984 2180 C5C1.tmp 104 PID 2180 wrote to memory of 3984 2180 C5C1.tmp 104 PID 3984 wrote to memory of 2872 3984 C63E.tmp 105 PID 3984 wrote to memory of 2872 3984 C63E.tmp 105 PID 3984 wrote to memory of 2872 3984 C63E.tmp 105 PID 2872 wrote to memory of 3120 2872 C728.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\464ef6eedef535ef253419ae9abfa3ea_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\B98C.tmp"C:\Users\Admin\AppData\Local\Temp\B98C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\BA38.tmp"C:\Users\Admin\AppData\Local\Temp\BA38.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\BB32.tmp"C:\Users\Admin\AppData\Local\Temp\BB32.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"C:\Users\Admin\AppData\Local\Temp\BC0C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\C37F.tmp"C:\Users\Admin\AppData\Local\Temp\C37F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"C:\Users\Admin\AppData\Local\Temp\C4F6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\C63E.tmp"C:\Users\Admin\AppData\Local\Temp\C63E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\C728.tmp"C:\Users\Admin\AppData\Local\Temp\C728.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"23⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"24⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"25⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"26⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"27⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"C:\Users\Admin\AppData\Local\Temp\CBFB.tmp"28⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"29⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"30⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"31⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"32⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"33⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\D179.tmp"C:\Users\Admin\AppData\Local\Temp\D179.tmp"34⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\D205.tmp"C:\Users\Admin\AppData\Local\Temp\D205.tmp"35⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"36⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"37⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"38⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"39⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"40⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\D59F.tmp"C:\Users\Admin\AppData\Local\Temp\D59F.tmp"41⤵
- Executes dropped EXE
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\D63C.tmp"C:\Users\Admin\AppData\Local\Temp\D63C.tmp"42⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"C:\Users\Admin\AppData\Local\Temp\D6E7.tmp"43⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\D784.tmp"C:\Users\Admin\AppData\Local\Temp\D784.tmp"44⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\D830.tmp"C:\Users\Admin\AppData\Local\Temp\D830.tmp"45⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"C:\Users\Admin\AppData\Local\Temp\D8BC.tmp"46⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"47⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"48⤵
- Executes dropped EXE
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\DA72.tmp"C:\Users\Admin\AppData\Local\Temp\DA72.tmp"49⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"50⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"C:\Users\Admin\AppData\Local\Temp\DBC9.tmp"51⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\DC75.tmp"C:\Users\Admin\AppData\Local\Temp\DC75.tmp"52⤵
- Executes dropped EXE
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"53⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"C:\Users\Admin\AppData\Local\Temp\DD7F.tmp"54⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"55⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\DE98.tmp"C:\Users\Admin\AppData\Local\Temp\DE98.tmp"56⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"57⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"58⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"59⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"C:\Users\Admin\AppData\Local\Temp\E0EA.tmp"60⤵
- Executes dropped EXE
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"61⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"C:\Users\Admin\AppData\Local\Temp\E1F4.tmp"62⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\E251.tmp"C:\Users\Admin\AppData\Local\Temp\E251.tmp"63⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"C:\Users\Admin\AppData\Local\Temp\E2AF.tmp"64⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"65⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\E36B.tmp"C:\Users\Admin\AppData\Local\Temp\E36B.tmp"66⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"67⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E465.tmp"C:\Users\Admin\AppData\Local\Temp\E465.tmp"68⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"69⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"70⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"71⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\E687.tmp"C:\Users\Admin\AppData\Local\Temp\E687.tmp"72⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"73⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"74⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"75⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"76⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"77⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\EA12.tmp"C:\Users\Admin\AppData\Local\Temp\EA12.tmp"78⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"79⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"C:\Users\Admin\AppData\Local\Temp\EB4A.tmp"80⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"C:\Users\Admin\AppData\Local\Temp\EBC7.tmp"81⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\EC54.tmp"C:\Users\Admin\AppData\Local\Temp\EC54.tmp"82⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"83⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"C:\Users\Admin\AppData\Local\Temp\ED5D.tmp"84⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"85⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\EE67.tmp"C:\Users\Admin\AppData\Local\Temp\EE67.tmp"86⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"87⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"88⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"C:\Users\Admin\AppData\Local\Temp\EFFD.tmp"89⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"90⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"91⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"C:\Users\Admin\AppData\Local\Temp\F1B3.tmp"92⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\F220.tmp"C:\Users\Admin\AppData\Local\Temp\F220.tmp"93⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"94⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"95⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"C:\Users\Admin\AppData\Local\Temp\F3C6.tmp"96⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\F443.tmp"C:\Users\Admin\AppData\Local\Temp\F443.tmp"97⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"C:\Users\Admin\AppData\Local\Temp\F4C0.tmp"98⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"99⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"C:\Users\Admin\AppData\Local\Temp\F5CA.tmp"100⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"101⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"102⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F770.tmp"C:\Users\Admin\AppData\Local\Temp\F770.tmp"103⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"104⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"105⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"106⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"107⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"C:\Users\Admin\AppData\Local\Temp\FA1F.tmp"108⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"109⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"110⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"111⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"112⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"113⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"114⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"115⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"116⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"117⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"118⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"119⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"120⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\97.tmp"C:\Users\Admin\AppData\Local\Temp\97.tmp"121⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\143.tmp"C:\Users\Admin\AppData\Local\Temp\143.tmp"122⤵PID:3420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-